Getting Data In

IndexProcessor - "Waiting for HTTPServer to start" when using config files to create token

packland
Path Finder

Hi,

I'm running splunk in a distributed environment and the web console for creating HEC tokens presented various issues that lead me to creating them using config files as per the documentation. However with my new token configuration (it's fine without it) the splunk service will not start and the last log found in $SPLUNK_HOME/var/log/splunk/splunkd.log is:

INFO IndexProcessor - initClustering (peer): Waiting for HTTPServer to start...

here is the config I added in $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf:

[http://<token_name>]
description = ...
disabled = 0
index = <index_name>
sourcetype = ...
token = <token_value>

I'll note that the index name I used isn't actually an existing index, and I realise I'll have to configure the index before using it but even with that line commented out, I get the same issue.

Any help would be greatly appreciated and of course, I'd be happy to help out with more info wherever needed.

Thanks

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...