Getting Data In

Events from the http collector end point should be the only ones forwarded to the indexers found in the outputs.conf group

lpolo
Motivator

Symptom of the problem:

When configuring a http_collector input with an outputs.conf group in an active splunk indexer, It looks like, the indexer in question forwards the events received from other sources to the indexers found in the /opt/splunk/etc/apps/splunk_httpinput/outputs.conf. This is not the expected behaviour.
Events from the http collector end point should be the only ones forwarded to the indexers found in the outputs.conf. None of the events hitting "receiving port 9997" should be forwarded.

Splunk Version: 6.4.1 Splunk Build: debde650d26e

Configs:

**/opt/splunk/etc/apps/splunk_httpinput/local**

**/opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf**
[http://Token for DMD Team]
disabled = 0
index = dmd
indexes = dmd
token = 1ZZWWA62-AGFA-43BF-9B29-41S0E39335GF
useACK = 0

[http]
disabled = 0
outputGroup = httpC

**/opt/splunk/etc/apps/splunk_httpinput/local/outputs.conf**

[tcpout:httpC]
server = server1:9997,serverm:9997
autoLB = true
autoLBFrequency = 30

**/opt/splunk/etc/apps/search/local/inputs.conf:**
[splunktcp://9997]
connection_host = ip
disabled = 0

Does anyone have experience this issue? Or is there something wrong with the configs?
Thanks,
Lp

Tags (1)
0 Karma

lpolo
Motivator

I solved this issue by setting up a Virtual Machine dedicated as httpInputCollector and forwarder. Otherwise, Indexers should be blacklisted which make the configuration awkward.

0 Karma

Masa
Splunk Employee
Splunk Employee

Generally, btool output for outputs.conf will tell us more.
If all events are forwarded to httpC output group. Something is related to defaultGroup attribute value in general.

But, it could be different reason. Of course, for potential a bug, it is worth filing a Support case and upload diag to the case.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...