Getting Data In

Is there a way to set up an HTTP event collector specific to a Splunk App?

Explorer

Is there a way to create an HTTP event collector specific to a Splunk app? I have multiple apps within my Splunk Cloud and would like to create an event collector which is specific to an app. Any suggestions on how to get this done?

0 Karma

Splunk Employee
Splunk Employee

The default configs for the HTTP Event Collector are included within the following app.

$SPLUNK_HOME/etc/apps/splunk_httpinput

Any new input created through the UI is placed in the local directory of this app and can be managed through the REST API.

You can define http inputs within the scope of any app but they can not be managed (enabled, disabled) via the REST API. This is by design. Including http inputs within custom apps is not a recommended best practice approach even though it will work.

0 Karma

Motivator

Under "$SPLUNK_HOME/etc/apps/splunk_httpinput" is where the outputs.conf will be placed so all http events will be forwarded to splunk indexers?

Thanks,
Lp

0 Karma