topic Re: SC4S: parsing_err="Incorrect index, index='main'" in Getting Data In

SC4S: parsing_err="Incorrect index, index='main'"

pepitogrillospl — Fri, 29 Dec 2023 11:55:11 GMT

Hi all,

I've setup am SC4S just to forward nix:syslog events.

In local/context/splunk_metadata.csv:

nix_syslog,index,the_index
nix_syslog,sourcetype,nix:syslog

Cant find the events inSplunk and splunkd.log is filling with:

12-29-2023 09:52:50.993 +0000 ERROR HttpInputDataHandler [2140 HttpDedicatedIoThread-0] - Failed processing http input, token name=the_token, channel=n/a, source_IP=172.18.0.1, reply=7, events_processed=1, http_input_body_size=1091, parsing_err="Incorrect index, index='main'"

The HEC probes at sc4s boot are successful and inserted in the correct index.

Any help would be really appreciated.

Thank you

Daniel

Re: SC4S: parsing_err="Incorrect index, index='main'"

GetAGrip1011 — Wed, 20 Mar 2024 15:05:57 GMT

Did you ever figure out a solution to this? Running into the same problem. Seems that there is an issue with where the HEC key points, and the actual index that gets populated.

Re: SC4S: parsing_err="Incorrect index, index='main'"

pepitogrillospl — Thu, 21 Mar 2024 07:56:22 GMT

Hi,

If I recall correctly at HEC token creation do not select any index , use local/context/splunk_metadata.csv for that. I think that fixed it.

Daniel

Re: SC4S: parsing_err="Incorrect index, index='main'"

GetAGrip1011 — Thu, 21 Mar 2024 17:14:23 GMT

That makes sense. Thank you for replying. Do you have an example splunk_metadata.csv file? The Splunk documentation mentions separating items by vendor/type, but they do not mention where to find those.