Getting Data In

IndexProcessor - "Waiting for HTTPServer to start" when using config files to create token

Path Finder


I'm running splunk in a distributed environment and the web console for creating HEC tokens presented various issues that lead me to creating them using config files as per the documentation. However with my new token configuration (it's fine without it) the splunk service will not start and the last log found in $SPLUNK_HOME/var/log/splunk/splunkd.log is:

INFO IndexProcessor - initClustering (peer): Waiting for HTTPServer to start...

here is the config I added in $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf:

description = ...
disabled = 0
index = <index_name>
sourcetype = ...
token = <token_value>

I'll note that the index name I used isn't actually an existing index, and I realise I'll have to configure the index before using it but even with that line commented out, I get the same issue.

Any help would be greatly appreciated and of course, I'd be happy to help out with more info wherever needed.


0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...