Getting Data In

HTTP 503 status code from HEC during high load

keio_splunk
Splunk Employee
Splunk Employee

Rsyslogd server is setup to send syslog messages to Splunk HTTP Event Collector (HEC) using omhttp module. During high load, HEC sending the following response to rsyslogd server: http status code: 503 reply: {"text":"Server is busy", "code":9, "invalid-event-number":0}. How to address this issue?

Tags (1)
0 Karma
1 Solution

keio_splunk
Splunk Employee
Splunk Employee

HEC input queue is full and is telling Rsyslogd server that it is busy.

The HEC queueSize has to be increased to cope with the syslog messages:
1. Set the queueSize under the [http://] stanzas in $SPLUNK_HOME/etc/system/local/input.conf. Note: indicates the token name as assigned by the user, apply to individual tokens. Settings specified here override settings specified within the [http] stanza.
2. Restart the Splunk server.

Refer to http://dev.splunk.com/view/event-collector/SP-CAAAE6Q.

View solution in original post

keio_splunk
Splunk Employee
Splunk Employee

HEC input queue is full and is telling Rsyslogd server that it is busy.

The HEC queueSize has to be increased to cope with the syslog messages:
1. Set the queueSize under the [http://] stanzas in $SPLUNK_HOME/etc/system/local/input.conf. Note: indicates the token name as assigned by the user, apply to individual tokens. Settings specified here override settings specified within the [http] stanza.
2. Restart the Splunk server.

Refer to http://dev.splunk.com/view/event-collector/SP-CAAAE6Q.

Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...