topic Re: HTTP Event Collector on Heavy forwared in Getting Data In

HTTP Event Collector on Heavy forwared

riqbal47010 — Wed, 17 Jul 2019 06:36:02 GMT

I want to configure HTTP Event collector on one of the Heavy forwarder.
initially i create the app with named splunk_httpinput

inputs.conf

[http]
useDeploymentServer = 1
index = hec

for outputs.conf , I will use the standard app to forward logs to indexer cluster.

Re: HTTP Event Collector on Heavy forwared

adonio — Wed, 17 Jul 2019 11:21:47 GMT

what is the question?

Re: HTTP Event Collector on Heavy forwared

riqbal47010 — Wed, 30 Sep 2020 01:24:20 GMT

I have distributed environment and I configure the HEC on one of the heavy forwarder.
i already create one app on deployment server and enable the following parameters in

inputs.conf file.

[http]

useDeploymentServer = 1

After that I login to Deployment server and generate the token. that token parameters are also reflecting in /opt/splunk/etc/deployment_apps/splunk_httpinput/local/inputs.conf

My goal is to receive HTTP event on Heavy forwarder and forward them to Indexer cluster.

so my question is :

1- I already created on app named splunk_httpinput on CM with indexes.conf file but it is not pushig. So what is missing part here.

2- its mandatory to created outputs.conf file in splunk_httinput app or my default outputs.conf app will handle this part.

Hope this clears the road .

Re: HTTP Event Collector on Heavy forwared

teunlaan — Fri, 19 Jul 2019 11:31:08 GMT

We collect HEC on a heavy, and enable it in the following way

1) enable hec on the heavy splunk http-event-collector enable
2) push the rest of the setting By the deployment server.

So it the app isn't pushed, did you configure the serverclass?
Also please use a different app name, like 'splunk_httpinput-custom' so you're 100% sure it won't overwrite the settings on your heavy