How To Create HEC Http_Input in Indexer Cluster Envirmment

[AliMaher]

Hello,

I want to create Input: HEC on the indexers => Indexer Cluster.

Create inputs.conf under /opt/splunk/etc/master-apps/_cluster/http_input/local:

[http]
disabled=0
enableSSL=0

[http://hec-input]
disabled=0
enableSSL=0
#useACK=true
index=HEC
source=HEC_Source
sourcetype=_json
token=2f5c143f-b777-4777-b2cc-ea45a4288677

Push these configuration to the peer-app (Indexers).

But we go to the Data inputs => HTTP Event Collector  at indexer Side

we still found it as below:

 

[PickleRick]

What do you mean by "we go to the Data inputs => HTTP Event Collector at indexer Side"?

You have WebUI enabled on your clustered indexers? It's a big no-no.

[AliMaher]

Yes, I know the WebUI should be disabled for the indexers, but it's test environment so it's enabled.

[marnall]

You shouldn't need to put inputs.conf into master-apps/_cluster/http_input/local, it should either go into master-apps/_cluster/local or master-apps/http_input/local . Try moving it into _cluster/local or http_input/local.

[AliMaher]

Kindly, let me know why you need to skip _cluster path?

[marnall]

In terms of pathing to the config file, you can think of _cluster as an app. So you can do:

master-apps/_cluster/local

-or-

master-apps/<yourapp>/local

But it makes no sense to have both:

master-apps/_cluster/<yourapp>/local

ref: https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Updatepeerconfigurations

Also one other thing came to mind: You are using the old name "master-apps" rather than the new name "manager-apps". This is fine as long as all your apps are placed either in master-apps or manager-apps, but your apps should not be in both folders.