Getting Data In

POST/services/data/inputs/http/httpadmin********8089

johnfaldo3
New Member

I'm running universalforwarder as a service in docker, here is my docker-compose config:

services:

 

 

 

services:

  splunkuniversalforwarder:
    platform: "linux/amd64"
    hostname: splunkuniversalforwarder
    image: splunk/universalforwarder:latest
    volumes:
      - opt-splunk-etc:/opt/splunk/etc
      - opt-splunk-var:/opt/splunk/var
      - ./splunk/splunkclouduf.spl:/tmp/splunkclouduf.spl
    ports:
      - "8000:8000"
      - "9997:9997"
      - "8088:8088"
      - "1514:1514"
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_USER=root
      - SPLUNK_ENABLE_LISTEN=9997
      - SPLUNK_CMD="/opt/splunkforwarder/bin/splunk install app /tmp/splunkclouduf.spl"
      - DEBUG=true
      - SPLUNK_PASSWORD=<root password>
      - SPLUNK_HEC_TOKEN=<HEC token>
      - SPLUNK_HEC_SSL=false​

 

 

 

 

I have a HTTP Event Collector configured in my Splunk Free Trial account.
 
When running docker-compose a lot of things seem to be going well and then i hit this:

 

 

 

TASK [splunk_universal_forwarder : Setup global HEC] ***************************
fatal: [localhost]: FAILED! => {
"changed": false
}

MSG: POST/services/data/inputs/http/httpadmin********8089{'disabled': '0', 'enableSSL': '0', 'port': '8088', 'serverCert': '', 'sslPassword': ''}NoneNoneNone;;; AND excep_str: No Exception, failed with status code 404: {"text":"The requested URL was not found on this server.","code":404}

 

 

 

 

I can see no reference to POST/services/data/inputs/http/httpadmin in any Splunk docs 😞

Can anyone shed any light on this please? 

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

While I do agree with @isoutamo that HEC on UF is not supported, it can be configured there. It's just unsupported and everyone pretends it's not there 😉

But more to the point, you're apparently trying to use some compose file which assumes you're working with a full Splunk Enterprise installation. While UF provides some REST API endpoints, it doesn't provide full functionality which is expected.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if I understand right, you are trying to configure HEC receiver on this node?

Splunk UF doesn’t support HEC! When you want to use HEC, the instance must be full splunk enterprise like heavy forwarder.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...