Getting Data In

HTTP 503 status code from HEC during high load

keio_splunk
Splunk Employee
Splunk Employee

Rsyslogd server is setup to send syslog messages to Splunk HTTP Event Collector (HEC) using omhttp module. During high load, HEC sending the following response to rsyslogd server: http status code: 503 reply: {"text":"Server is busy", "code":9, "invalid-event-number":0}. How to address this issue?

Tags (1)
0 Karma
1 Solution

keio_splunk
Splunk Employee
Splunk Employee

HEC input queue is full and is telling Rsyslogd server that it is busy.

The HEC queueSize has to be increased to cope with the syslog messages:
1. Set the queueSize under the [http://] stanzas in $SPLUNK_HOME/etc/system/local/input.conf. Note: indicates the token name as assigned by the user, apply to individual tokens. Settings specified here override settings specified within the [http] stanza.
2. Restart the Splunk server.

Refer to http://dev.splunk.com/view/event-collector/SP-CAAAE6Q.

View solution in original post

keio_splunk
Splunk Employee
Splunk Employee

HEC input queue is full and is telling Rsyslogd server that it is busy.

The HEC queueSize has to be increased to cope with the syslog messages:
1. Set the queueSize under the [http://] stanzas in $SPLUNK_HOME/etc/system/local/input.conf. Note: indicates the token name as assigned by the user, apply to individual tokens. Settings specified here override settings specified within the [http] stanza.
2. Restart the Splunk server.

Refer to http://dev.splunk.com/view/event-collector/SP-CAAAE6Q.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...