Getting Data In

Can you distribute an Http Event Collector (HEC) without restarting?

freaklin
Path Finder

Hi,

I use to share my HEC tokens with the index cluster via deployment server. When I create the new token into Cluster Master, It doesn't require me a restart. But, when I share the inputs.conf via deployment-server and this conf goes to the indexer(or forwarder), It requires a restart in order to enable the new tokens.

Is there a way to push the tokens avoiding indexer(or forwarder) restart?

0 Karma

iamarkaprabha
Contributor

Hi ,

I would suggest you to create a serverclass and put the http_input app over there in the Deployment server,
Then reload the serverclass from the DS. You don't need to restart splunk over there anymore

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!