topic Re: How To Create HEC Http_Input in Indexer Cluster Envirmment in Getting Data In

How To Create HEC Http_Input in Indexer Cluster Envirmment

AliMaher — Sat, 23 Nov 2024 15:18:39 GMT

Hello,

I want to create Input: HEC on the indexers => Indexer Cluster.

Create inputs.conf under /opt/splunk/etc/master-apps/_cluster/http_input/local:

[http] disabled=0 enableSSL=0 [http://hec-input] disabled=0 enableSSL=0 #useACK=true index=HEC source=HEC_Source sourcetype=_json token=2f5c143f-b777-4777-b2cc-ea45a4288677

Push these configuration to the peer-app (Indexers).

But we go to the Data inputs => HTTP Event Collector at indexer Side

we still found it as below:

Re: How To Create HEC Http_Input in Indexer Cluster Envirmment

marnall — Sat, 23 Nov 2024 14:22:53 GMT

You shouldn't need to put inputs.conf into master-apps/_cluster/http_input/local, it should either go into master-apps/_cluster/local or master-apps/http_input/local . Try moving it into _cluster/local or http_input/local.

Re: How To Create HEC Http_Input in Indexer Cluster Envirmment

PickleRick — Sat, 23 Nov 2024 15:37:43 GMT

What do you mean by "we go to the Data inputs => HTTP Event Collector at indexer Side"?

You have WebUI enabled on your clustered indexers? It's a big no-no.

Re: How To Create HEC Http_Input in Indexer Cluster Envirmment

AliMaher — Sat, 23 Nov 2024 17:37:15 GMT

Yes, I know the WebUI should be disabled for the indexers, but it's test environment so it's enabled.

Re: How To Create HEC Http_Input in Indexer Cluster Envirmment

AliMaher — Sat, 23 Nov 2024 17:39:16 GMT

Kindly, let me know why you need to skip _cluster path?

Re: How To Create HEC Http_Input in Indexer Cluster Envirmment

marnall — Sat, 23 Nov 2024 17:55:57 GMT

In terms of pathing to the config file, you can think of _cluster as an app. So you can do:

master-apps/_cluster/local

-or-

master-apps/<yourapp>/local

But it makes no sense to have both:

master-apps/_cluster/<yourapp>/local

ref: https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Updatepeerconfigurations

Also one other thing came to mind: You are using the old name "master-apps" rather than the new name "manager-apps". This is fine as long as all your apps are placed either in master-apps or manager-apps, but your apps should not be in both folders.