https://community.splunk.com/t5/Splunk-Dev/HEC-random-issue/m-p/417039#M7272 <P>Hello,</P> <P>I'm using HEC to send data to our splunk cloud instance in _json format. Currently I have 2 pods - 1 HEC - 2 indexes architecture.<BR /> I do a "transaction" and I have 3 splunk JSON events going one to indexA and the 2 others to indexB.</P> <P>Randomly I'm getting an error <BR /> {"type":"INTERNAL","description":"error during post to splunk for tenantId=monitoring err=StatusCodeError: 400 - {\\"text\\":\\"Incorrect index\\",\\"code\\":7,\\"invalid-event-number\\":1}"},</P> <P>However indexes are correct as I see events on them. For example in the log sample above I have only one event in indexB (Where I should have 2) and one in indexA. Sometimes is one event failing, sometimes 2, and sometimes is one index and sometimes is the other.</P> <P>In introspection index I see parse error is 1, however I don't know where I can see a more detailed explanation. <BR /> I've already check HTTP collector troubleshooting page, again I'm in splunk cloud with no access to config files, so I'm kind of block.</P> <P>Can someone help me to either to know how to get more information or share if you've faced a similar issue?</P> Mon, 10 Jun 2019 11:07:37 GMT smalonso 2019-06-10T11:07:37Z https://community.splunk.com/t5/Splunk-Dev/HEC-random-issue/m-p/417039#M7272 <P>Hello,</P> <P>I'm using HEC to send data to our splunk cloud instance in _json format. Currently I have 2 pods - 1 HEC - 2 indexes architecture.<BR /> I do a "transaction" and I have 3 splunk JSON events going one to indexA and the 2 others to indexB.</P> <P>Randomly I'm getting an error <BR /> {"type":"INTERNAL","description":"error during post to splunk for tenantId=monitoring err=StatusCodeError: 400 - {\\"text\\":\\"Incorrect index\\",\\"code\\":7,\\"invalid-event-number\\":1}"},</P> <P>However indexes are correct as I see events on them. For example in the log sample above I have only one event in indexB (Where I should have 2) and one in indexA. Sometimes is one event failing, sometimes 2, and sometimes is one index and sometimes is the other.</P> <P>In introspection index I see parse error is 1, however I don't know where I can see a more detailed explanation. <BR /> I've already check HTTP collector troubleshooting page, again I'm in splunk cloud with no access to config files, so I'm kind of block.</P> <P>Can someone help me to either to know how to get more information or share if you've faced a similar issue?</P> Mon, 10 Jun 2019 11:07:37 GMT https://community.splunk.com/t5/Splunk-Dev/HEC-random-issue/m-p/417039#M7272 smalonso 2019-06-10T11:07:37Z https://community.splunk.com/t5/Splunk-Dev/HEC-random-issue/m-p/417040#M7273 <P>Hello, for anyone interested and update on this issue:</P> <P>The problem happens when using 1 server - 2 HEC - 4 indexes (2 for each HEC) <BR /> I made a few tests such as</P> <UL> <LI>2 pod - 1 HEC - 4 indexes<BR /></LI> <LI>2 pods - 2 HEC - 2 indexes (Only one index per HEC)</LI> </UL> <P>In both cases the issue is not present. I couldn't find the reason yet. </P> Wed, 12 Jun 2019 09:59:49 GMT https://community.splunk.com/t5/Splunk-Dev/HEC-random-issue/m-p/417040#M7273 smalonso 2019-06-12T09:59:49Z