topic Re: Where to set HEC httpinputq value ? in Getting Data In

Where to set HEC httpinputq value ?

splunk_job — Fri, 14 Aug 2020 04:58:42 GMT

This is related to HEC queue size.

When I execute "index=_internal host=abc group="queue" name="httpinputq" | eval name=name+":"+host | stats values(name) by max_size_kb" => max_size_kb value showing as 107520KB.

Based on how indexing works diagram https://wiki.splunk.com/Community:HowIndexingWorks, HEC uses httpinputq but I am not able to find anything related to httpinpuq in Splunk Docs.

I am not sure from which configuration file max_size_kb value showing as 107520KB. I verified in all server.conf and inputs.conf files, but with no luck. Need help here to understand the source of max_size_kb value.

I also referred but with no luck: https://community.splunk.com/t5/All-Apps-and-Add-ons/When-HF-with-quot-Splunk-DB-Connect-quot-send-data-to-Indexer/td-p/418246

Re: Where to set HEC httpinputq value ?

harsmarvania57 — Fri, 14 Aug 2020 09:26:06 GMT

To set httpinputq, below configuration is working in server.conf

Please change queue size as per your requirement.

[queue=httpInputQ] maxSize = 10MB

Re: Where to set HEC httpinputq value ?

splunk_job — Fri, 14 Aug 2020 09:39:43 GMT

Thank you for your quick response @harsmarvania57

when I run above splunk query, existing max_size_kb value showing as 107520KB. But, I am not able to find from where this value is coming from. It's not there in any .conf files (Not in server.conf too).

Re: Where to set HEC httpinputq value ?

harsmarvania57 — Fri, 14 Aug 2020 09:40:52 GMT

Have you tried to check server.conf config using btool ?

Re: Where to set HEC httpinputq value ?

splunk_job — Mon, 17 Aug 2020 04:37:59 GMT

@harsmarvania57 No luck with btool also. It's weird.

Re: Where to set HEC httpinputq value ?

harsmarvania57 — Mon, 17 Aug 2020 09:42:13 GMT

In that case, you have peristent queue configured. Check inputs.conf using btool for peristent queue.

Re: Where to set HEC httpinputq value ?

splunk_job — Thu, 27 Aug 2020 04:37:29 GMT

server.conf and also as stated in your previous post, "queueSize" in inputs.conf also worked.

Thanks for your help and quick response on this.

https://community.splunk.com/t5/All-Apps-and-Add-ons/When-HF-with-quot-Splunk-DB-Connect-quot-send-d...

https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Inputsconf#HTTP_Event_Collector_.28HEC.29_-_Local_stanza_for_each_token