Getting Data In

How to write http stanza in inputs.conf file for HEC configuration?

syazwani
Path Finder

Hi, i need help on writing the [http] stanza in inputs.conf  for HEC token configuration. Please assist. Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the GUI to set up a HEC input then copy the created stanza as necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

syazwani
Path Finder

Hi @richgalloway , yea i did configure from the UI for HEC. And we face an error from Splunk "server are busy". We tried to look at the input.conf and some stanza are missing. We figure out that we need http stanza set the token name. But we dont know the correct format for the stanza. We have look into splunk documentation, somehow it didnt help us. Anyway, did you know the format stanza for it?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"Server is busy" does not mean the HEC configuration is missing anything.  It means the server is busy processing other inputs.  See https://community.splunk.com/t5/Getting-Data-In/HttpInputDataHandler-parsing-error-Server-is-busy/m-... and https://community.splunk.com/t5/Monitoring-Splunk/How-to-fix-error-Server-is-busy-HTTP-Event-Collect...

How did you conclude you need to set the token name?  That should have been done by the GUI.

See https://docs.splunk.com/Documentation/Splunk/9.0.2/Admin/Inputsconf#HTTP_Event_Collector_.28HEC.29_-... for documentation on the http stanza.  What information do you need that is not documented?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...