topic Re: How to write http stanza in inputs.conf file for HEC Configuration? in Getting Data In

How to write http stanza in inputs.conf file for HEC configuration?

syazwani — Fri, 09 Dec 2022 19:50:16 GMT

Hi, i need help on writing the [http] stanza in inputs.conf for HEC token configuration. Please assist. Thank you.

Re: How to write http stanza in inputs.conf file for HEC Configuration?

richgalloway — Fri, 09 Dec 2022 16:12:28 GMT

Use the GUI to set up a HEC input then copy the created stanza as necessary.

Re: How to write http stanza in inputs.conf file for HEC Configuration?

syazwani — Tue, 13 Dec 2022 01:51:46 GMT

Hi @richgalloway , yea i did configure from the UI for HEC. And we face an error from Splunk "server are busy". We tried to look at the input.conf and some stanza are missing. We figure out that we need http stanza set the token name. But we dont know the correct format for the stanza. We have look into splunk documentation, somehow it didnt help us. Anyway, did you know the format stanza for it?

Re: How to write http stanza in inputs.conf file for HEC Configuration?

richgalloway — Tue, 13 Dec 2022 15:04:49 GMT

"Server is busy" does not mean the HEC configuration is missing anything. It means the server is busy processing other inputs. See https://community.splunk.com/t5/Getting-Data-In/HttpInputDataHandler-parsing-error-Server-is-busy/m-p/468396 and https://community.splunk.com/t5/Monitoring-Splunk/How-to-fix-error-Server-is-busy-HTTP-Event-Collector/m-p/587904

How did you conclude you need to set the token name? That should have been done by the GUI.

See https://docs.splunk.com/Documentation/Splunk/9.0.2/Admin/Inputsconf#HTTP_Event_Collector_.28HEC.29_-_Local_stanza_for_each_token for documentation on the http stanza. What information do you need that is not documented?