topic Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light? in Splunk Enterprise

Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

otryshko — Tue, 09 Jun 2020 22:32:11 GMT

Hi,

I just downloaded and installed Splunk Light on-prem and I'm trying to use HTTP Event Collector walk-through ( http://dev.splunk.com/view/event-collector/SP-CAAAE7F) with postman/curl. I tried all kinds of sample data, but I get:

{
  "text": "Data channel is missing",
  "code": 10
}

from https://localhost:8088/services/collector/event endpoint. Please help?

Thanks
Voffka

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

jterry — Mon, 11 Apr 2016 17:30:53 GMT

using the "curl" example in the docs i was able add an event to Splunk Light via the HTTP Event Collector.

curl -k  https://localhost:8088/services/collector/event -H "Authorization: Splunk " -d '{"event": "hello world"}

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

dkoshe_splunk — Mon, 11 Apr 2016 18:20:49 GMT

Hello Voffka,
Can you give example of curl request you are trying?

Also did you make sure that a HTTP Event collection is enabled and a new token is generated?

-D

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

otryshko — Mon, 11 Apr 2016 22:43:24 GMT

this is the curl code Postman generated for me:

curl -X POST -H "Authorization: Splunk 9969503D-2D88-4C80-A6BC-A7FBE14736C7" -H "Cache-Control: no-cache" -H "Postman-Token: bd0646b6-0193-a4f3-eadd-835a57376af6" -d '{
    "event": { "hello": "world" }
}' "https://localhost:8088/services/collector/event"

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

gblock_splunk — Mon, 11 Apr 2016 22:48:36 GMT

@otryshko based on the error my guess is you have enabled indexer acknowledgment on the token. If so, then you have to supply a channel. You can find this in our API docs. If you disable indexer acknowledgment for the token you won't need to supply channel.

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

otryshko — Mon, 11 Apr 2016 23:04:59 GMT

Yes, I enabled event collection via global settings func. Below is the actual command line I run on windows:

curl -k -H "Authorization: Splunk 9969503D-2D88-4C80-A6BC-A7FBE14736C7" -d "{'event': { 'hello': 'world'}}" "https://localhost:8088/services/collector/event"

Have I misconfigured anything on the splunk side? I pretty much downloaded the light msi, ran it and followed the walk-through.

What are the conditions data channel could be reported as missing? I see this error text in splnkd.exe but googling for this error returns nothing.

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

gblock_splunk — Mon, 11 Apr 2016 23:12:56 GMT

Read my comment below. That error is likely because you enabled indexer acknowledgment on the token.

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

otryshko — Mon, 11 Apr 2016 23:25:13 GMT

@gblock - yes, it was the reason! Thank you for helping me out.

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

gblock_splunk — Mon, 11 Apr 2016 23:31:41 GMT

Awesome, glad that was it. This setting has thrown off a few folks. We probably need a better error message or something.

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

GeorgeStarkey — Fri, 08 Jul 2016 16:55:45 GMT

Where in the docs is this referenced?

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

andrewb_splunk — Mon, 11 Jul 2016 17:00:56 GMT

@GeorgeStarkey, this is documented on our developer documentation site. The specific link in this case is http://dev.splunk.com/view/event-collector/SP-CAAAE8X#aboutchannels.

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

arindamlaha — Mon, 16 Jan 2017 20:53:32 GMT

@ gblock [Splunk], I was able to solve this issue by disabling the indexer acknowledgements in the HEC config. However I was wondering if you could help me to define the [client id] in the Splunk enterprise.
Appreciate your help in advance!

Thanks,
Arindam

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

marcellodesales — Sat, 24 Jun 2017 00:31:54 GMT

This also worked for me!!! thanks a lot!

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

edquijano — Fri, 07 Sep 2018 22:13:32 GMT

sos grande !

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

dwilliams03 — Tue, 18 Jun 2019 01:56:45 GMT

Thank you! I was beating my head against the wall. Don't know how this got turned on in my setup but it definitely stopped everything.

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

rphillips_splk — Wed, 01 Apr 2020 22:04:52 GMT

About channels and sending data
Sending events with indexer acknowledgment enabled is similar to sending them without the setting enabled. However, there is one crucial difference: specifying a channel.

The concept of a channel was introduced in HEC primarily to prevent a fast client from impeding the performance of a slow client. When you assign one channel per client, because channels are treated equally on the Splunk server, one client can't affect another.

You must include a matching channel identifier both when sending data to HEC in an HTTP request and when requesting acknowledgement that events contained in the request have been indexed. If you don't, you will receive the error message, "Data channel is missing." Each request that includes a token for which indexer acknowledgement has been enabled must include a channel identifier

inputs.conf (indexers acting as HEC receiver, customers also use HFs as HEC receivers)

inputs.conf

[http]
disabled =0

[http://idx_cluster_token]
disabled = 0
index = main
indexes = main
token = b7223516-1d22-4a7g-b6b3-74adb44da5ff
useACK = 0

sample curl:
https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Senddata

if HEC receiver is not using indexer acknowledgement (useACK = 0):

curl -k -H "Authorization: Splunk b7223516-1d22-4a7g-b6b3-74adb44da5ff" https://hec.splunk.com:8088/services/collector/event -d '{"sourcetype": "mysourcetype", "event": "http auth ftw!"}'

if HEC receiver is using indexer acknowledgement (useACK = 1) you must supply a channel identifier:

curl -k -H "Authorization: Splunk b7223516-1d22-4a7g-b6b3-74adb44da5ff" -H "X-Splunk-Request-Channel: FE0ECFAD-13D5-401B-847D-77833BD77131" https://rplinux06.sv.splunk.com:8088/services/collector/event -d '{"sourcetype": "mysourcetype", "event": "http auth ftw! with ACKS"}'

NOTE: if your HEC receiver is using indexer acknowledgement and you don't specify a Channel Identifier (ie: X-Splunk-Request-Channel) you will see an error like:
{"text":"Data channel is missing","code":10}

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

patelmc — Tue, 18 May 2021 17:31:54 GMT

Where can I get channel info ?

Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light?

scentoni_splunk — Fri, 28 Jul 2023 23:41:35 GMT

From About HTTP Event Collector Indexer Acknowledgment:

Channels are designed so that you assign a unique channel to each client that sends data to HEC. Each channel has a channel identifier (ID), which must be a Globally Unique Identifier (GUID) but can be randomly generated. You assign channel IDs simply by including them in requests as shown in the examples above. When Splunk Enterprise sees a new channel identifier, it creates a new channel.

One way to create unique GUIDs is with the Python module uuid. Here is an example of how to do that with a GUID constructed from the local machine's hostname:

export HEC_CHANNEL=$(python3 -c "import os, uuid; print(str(uuid.uuid3(uuid.NAMESPACE_DNS, os.uname()[1])))")
curl \
-k \
https://$HEC_HOST:8088/services/collector/event \
-H "Authorization: Splunk $HEC_TOKEN" \
-H "X-Splunk-Request-Channel: $HEC_CHANNEL" \
-d '{"sourcetype": "mysourcetype", "event": "http auth ftw! with ACKS"}'