topic POST/services/data/inputs/http/httpadmin********8089 in Getting Data In

POST/services/data/inputs/http/httpadmin********8089

johnfaldo3 — Sat, 27 Apr 2024 10:01:44 GMT

I'm running universalforwarder as a service in docker, here is my docker-compose config:

services:

services: splunkuniversalforwarder: platform: "linux/amd64" hostname: splunkuniversalforwarder image: splunk/universalforwarder:latest volumes: - opt-splunk-etc:/opt/splunk/etc - opt-splunk-var:/opt/splunk/var - ./splunk/splunkclouduf.spl:/tmp/splunkclouduf.spl ports: - "8000:8000" - "9997:9997" - "8088:8088" - "1514:1514" environment: - SPLUNK_START_ARGS=--accept-license - SPLUNK_USER=root - SPLUNK_ENABLE_LISTEN=9997 - SPLUNK_CMD="/opt/splunkforwarder/bin/splunk install app /tmp/splunkclouduf.spl" - DEBUG=true - SPLUNK_PASSWORD=<root password> - SPLUNK_HEC_TOKEN=<HEC token> - SPLUNK_HEC_SSL=false

I have a HTTP Event Collector configured in my Splunk Free Trial account.

When running docker-compose a lot of things seem to be going well and then i hit this:

TASK [splunk_universal_forwarder : Setup global HEC] *************************** fatal: [localhost]: FAILED! => { "changed": false } MSG: POST/services/data/inputs/http/httpadmin********8089{'disabled': '0', 'enableSSL': '0', 'port': '8088', 'serverCert': '', 'sslPassword': ''}NoneNoneNone;;; AND excep_str: No Exception, failed with status code 404: {"text":"The requested URL was not found on this server.","code":404}

I can see no reference to POST/services/data/inputs/http/httpadmin in any Splunk docs 😞

Can anyone shed any light on this please?

Re: POST/services/data/inputs/http/httpadmin********8089

isoutamo — Sat, 27 Apr 2024 11:15:27 GMT

if I understand right, you are trying to configure HEC receiver on this node?

Splunk UF doesn’t support HEC! When you want to use HEC, the instance must be full splunk enterprise like heavy forwarder.

r. Ismo

Re: POST/services/data/inputs/http/httpadmin********8089

PickleRick — Sat, 27 Apr 2024 14:19:55 GMT

While I do agree with @isoutamo that HEC on UF is not supported, it can be configured there. It's just unsupported and everyone pretends it's not there 😉

But more to the point, you're apparently trying to use some compose file which assumes you're working with a full Splunk Enterprise installation. While UF provides some REST API endpoints, it doesn't provide full functionality which is expected.