6.3 Upgrade - Missing HTTP Event Collector Data Input Option

[photuris]

I just upgraded a local install of Splunk Enterprise from 6.2.4 (iirc) to 6.3. Restarted it, etc.

I'm not seeing the option to enable HTTP Event Collector in Settings -> Data Inputs. Although I was able to create a token in Data Inputs.

I could simply uninstall completely and reinstall, but I was hoping to not have to do that, as I have stuff in development. Is there an easy way to get this option to show up?

Ubuntu, 64-bit.

Thanks!

[gblock_splunk]

@photuris the inputs.conf you should be looking for is in etc/apps/splunk_httpinput. Can you tell me if that app exists? If so, can you send me a copy of it? [email protected]

[gblock_splunk]

@photuris how did you create the token if you did not see the HTTP Event Collector screen under inputs?

Can you email me [email protected] so we can get to the bottom of this?

Thanks
Glenn

[athorat]

Hi

I have a similar issue. I do not see HTTP Event Collector, under data inputs.

/opt/splunk/etc/apps/splunk_httpinput/default

inputs.conf

$ more inputs.conf
[http]
disabled=1
port=8088
enableSSL=1
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

I have the same version in non prod but the only difference is, prod is a search head clsuster and non prod has only one search head.
It is available in non prod, the file contents of inputs.conf are the same.

What Needs to be modified in inputs.conf.