topic Re: Need help generating Http Event Collector Token in Dashboards & Visualizations

Need help generating Http Event Collector Token

garyfj — Thu, 05 Mar 2020 00:14:23 GMT

Hi all, I can't seem to generate a HEC token.

Help is appreciated

Re: Need help generating Http Event Collector Token

jethrop — Thu, 05 Mar 2020 02:32:49 GMT

The account that splunk is running as, does it have rights in that denied directory? Also, to test, have you tried creating this with an admin account to check it's not a weird permissions problem?

Re: Need help generating Http Event Collector Token

garyfj — Wed, 30 Sep 2020 04:29:29 GMT

The account does have full access to the directory. I am also creating the token with an admin account.

I'm looking at two conf files for this but there doesn't seem to be permission issues

C:\Program Files\Splunk\etc\apps\splunk_httpinput\default\inputs.conf
C:\Program Files\Splunk\etc\deployment-apps\splunk_httpinput\local\inputs.conf

Re: Need help generating Http Event Collector Token

jethrop — Thu, 05 Mar 2020 04:02:24 GMT

Splunk version?

anything more in splunkd.log?

Re: Need help generating Http Event Collector Token

manjunathmeti — Thu, 05 Mar 2020 05:18:50 GMT

Set App Context to "splunk_httpinput" app in Input Settings.

If you use search app then updates will be written to:
C:\Program Files\Splunk\etc\apps\search\local\inputs.conf