Getting Data In
Highlighted

Is there a way to set up an HTTP event collector specific to a Splunk App?

Explorer

Is there a way to create an HTTP event collector specific to a Splunk app? I have multiple apps within my Splunk Cloud and would like to create an event collector which is specific to an app. Any suggestions on how to get this done?

0 Karma
Highlighted

Re: Is there a way to set up an HTTP event collector specific to a Splunk App?

Splunk Employee
Splunk Employee

The default configs for the HTTP Event Collector are included within the following app.

$SPLUNKHOME/etc/apps/splunkhttpinput

Any new input created through the UI is placed in the local directory of this app and can be managed through the REST API.

You can define http inputs within the scope of any app but they can not be managed (enabled, disabled) via the REST API. This is by design. Including http inputs within custom apps is not a recommended best practice approach even though it will work.

0 Karma
Highlighted

Re: Is there a way to set up an HTTP event collector specific to a Splunk App?

Motivator

Under "$SPLUNKHOME/etc/apps/splunkhttpinput" is where the outputs.conf will be placed so all http events will be forwarded to splunk indexers?

Thanks,
Lp

0 Karma