topic Re: Unable to see the log data in indexer read by HTTP Event Collector post reinstallation of Splunk package in Getting Data In

Unable to see the log data in indexer read by HTTP Event Collector post reinstallation of Splunk package

santosh_hb — Mon, 17 Jun 2019 10:54:58 GMT

Hi All,

Need a quick help on the below issue.

We had configured HTTP Event Collector to read Netflow logs on port 8088 on Splunk HF. (Splunk version was 7.2.1)
Token was generated and it was added on External Logger and was authenticated to connect to Splunk HF.
Now, for some reason we have stopped the Splunk on HF and reinstalled Splunk 7.1.6 on the same HF.
HTTP Event Collector configs are copied from previous configurations along with Token value.
Now, the data has stopped flowing into Indexer post this change.
Tried to check all the HTTP EVent Collector debug techniques but unable to understand the issue.
I even can't see any errors in internal logs coming from HF

I doubt the issue might be with Token that was created earlier. Do I need to recreate the HTTP token and reconfigure it.

Awaiting for your help.
regards,
Santosh

Re: Unable to see the log data in indexer read by HTTP Event Collector post reinstallation of Splunk package

VatsalJagani — Mon, 17 Jun 2019 12:59:08 GMT

@santosh_hb,
Check below configuration if all looks good then re-create the token and use that. (As you have changed Splunk version re-creation of token is probably require)

In Global Settings > All Tokens is enabled.
Port is 8088 only.
Enable SSL is set to proper value that you are using on sender side.
Your token is enabled.

Hope this helps!!!

Re: Unable to see the log data in indexer read by HTTP Event Collector post reinstallation of Splunk package

renjith_nair — Mon, 17 Jun 2019 13:01:32 GMT

@santosh_hb,

Yes, each token has a unique value, which is a 128-bit number that is represented as a 32-character globally unique identifier (GUID). You have to create new token after enabling HEC as described in Configure HTTP Event Collector on Splunk Enterprise in the new installation.