topic Re: How to resolve ERROR "Failed processing http input"? in Splunk Search

How to resolve ERROR "Failed processing http input"?

JNgoho — Tue, 03 Jan 2023 02:19:23 GMT

How can we Stop Docker from sending these logs?
We recently disable the ingestion from Docker to Splunk on the Splunk HEC settings.
But after we disable and delete the HEC settings in Splunk this issue occurs.

01-02-2023 09:33:13.494 -0800 ERROR HttpInputDataHandler [54154 HttpDedicatedIoThread-0] - Failed processing http input, token name=n/a, channel=n/a, source_IP=10.22.100.6, reply=4, events_processed=0, http_input_body_size=291831, parsing_err=""
01-02-2023 09:33:13.379 -0800 ERROR HttpInputDataHandler [54154 HttpDedicatedIoThread-0] - Failed processing http input, token name=n/a, channel=n/a, source_IP=10.22.100.6, reply=4, events_processed=0, http_input_body_size=225158, parsing_err=""

We are getting almost 5,000 ERROR every day.
We try to delete the daemon.json in the docker https://docs.docker.com/config/containers/logging/splunk/

But the docker is still sending error logs.

Re: How to resolve ERROR "Failed processing http input"?

scelikok — Tue, 03 Jan 2023 06:01:35 GMT

Hi @JNgoho,

Did you restart the container after deleting the daemon.json file?

Re: How to resolve ERROR "Failed processing http input"?

JNgoho — Tue, 03 Jan 2023 06:05:38 GMT

We restarted the Docker agent, and still error is sending

Re: How to resolve ERROR "Failed processing http input"?

Hemant_h — Tue, 15 Apr 2025 08:10:18 GMT

is your issue resolved? Getting the same error on HF for hec tokens