I want to configure HTTP Event collector on one of the Heavy forwarder.
initially i create the app with named splunk_httpinput
useDeploymentServer = 1
index = hec
for outputs.conf , I will use the standard app to forward logs to indexer cluster.
what is the question?
I have distributed environment and I configure the HEC on one of the heavy forwarder.
i already create one app on deployment server and enable the following parameters in
After that I login to Deployment server and generate the token. that token parameters are also reflecting in /opt/splunk/etc/deployment_apps/splunk_httpinput/local/inputs.conf
My goal is to receive HTTP event on Heavy forwarder and forward them to Indexer cluster.
so my question is :
1- I already created on app named splunk_httpinput on CM with indexes.conf file but it is not pushig. So what is missing part here.
2- its mandatory to created outputs.conf file in splunk_httinput app or my default outputs.conf app will handle this part.
Hope this clears the road .
We collect HEC on a heavy, and enable it in the following way
1) enable hec on the heavy splunk http-event-collector enable
2) push the rest of the setting By the deployment server.
splunk http-event-collector enable
So it the app isn't pushed, did you configure the serverclass?
Also please use a different app name, like 'splunk_httpinput-custom' so you're 100% sure it won't overwrite the settings on your heavy