Getting Data In

HTTP Event Collector Connection Actively Refused after upgrading from 9.0.5 to 9.1.1 (No Token Found)

C_Lawrence
Engager

Hi,

We have just upgraded to 9.1.1 and our HEC seems to have stopped working. 

Calling it from a simple PowerShell script worked the day before and running it now throws this error :

Unable to connect to the remote server
No connection could be made because the target machine actively refused it xxx.xxx.xxx.xxx:8088

So, headed over to the Forwarder where it should be listening, and the tokens do still exist in the Inputs.conf in "/opt/splunkforwarder/etc/apps/splunk_httpinput/local"

However, issuing the list command gives us the following :

$SPLUNK_HOME/bin/splunk http-event-collector list -uri https://localhost:8089

Token Not Found

The HEC is Enabled in the Global Settings but we are also not seeing anything listening on Port 8088

Splunk Enterprise on a Linux build.

Labels (2)
Tags (1)

emallinger
Communicator

Hi,

yes, that's exactly what I did and that fixed the issue in my case :).

Thanks !

Ema

0 Karma

emallinger
Communicator
0 Karma

C_Lawrence
Engager

Hi,

 

So sorry. I though I had update and resolved this message.

As I was trying to get logged in (it took a while!), you sent the other update. That was not the fix for me.

While I had a case open for while with Splunk, I cam across this fix :

On the Forwarder :

/opt/splunkforwarder/etc/system/local/server.conf

Add this Stanza :

[httpServer]
mgmtMode = tcp

 

Regards.

emallinger
Communicator

Hello,

Same symptoms here upgrading from 9.0.5 to 9.1.3...

Did you find out what was the workaround ?

What did you do ?

Thanks !

Ema

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...