POST/services/data/inputs/http/httpadmin********8089

[johnfaldo3]

I'm running universalforwarder as a service in docker, here is my docker-compose config:

services:

services:

  splunkuniversalforwarder:
    platform: "linux/amd64"
    hostname: splunkuniversalforwarder
    image: splunk/universalforwarder:latest
    volumes:
      - opt-splunk-etc:/opt/splunk/etc
      - opt-splunk-var:/opt/splunk/var
      - ./splunk/splunkclouduf.spl:/tmp/splunkclouduf.spl
    ports:
      - "8000:8000"
      - "9997:9997"
      - "8088:8088"
      - "1514:1514"
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_USER=root
      - SPLUNK_ENABLE_LISTEN=9997
      - SPLUNK_CMD="/opt/splunkforwarder/bin/splunk install app /tmp/splunkclouduf.spl"
      - DEBUG=true
      - SPLUNK_PASSWORD=<root password>
      - SPLUNK_HEC_TOKEN=<HEC token>
      - SPLUNK_HEC_SSL=false​

I have a HTTP Event Collector configured in my Splunk Free Trial account.

When running docker-compose a lot of things seem to be going well and then i hit this:

TASK [splunk_universal_forwarder : Setup global HEC] ***************************
fatal: [localhost]: FAILED! => {
"changed": false
}

MSG: POST/services/data/inputs/http/httpadmin********8089{'disabled': '0', 'enableSSL': '0', 'port': '8088', 'serverCert': '', 'sslPassword': ''}NoneNoneNone;;; AND excep_str: No Exception, failed with status code 404: {"text":"The requested URL was not found on this server.","code":404}

I can see no reference to POST/services/data/inputs/http/httpadmin in any Splunk docs 😞

Can anyone shed any light on this please? 

[PickleRick]

While I do agree with @isoutamo that HEC on UF is not supported, it can be configured there. It's just unsupported and everyone pretends it's not there 😉

But more to the point, you're apparently trying to use some compose file which assumes you're working with a full Splunk Enterprise installation. While UF provides some REST API endpoints, it doesn't provide full functionality which is expected.

[isoutamo]

Hi

if I understand right, you are trying to configure HEC receiver on this node?

Splunk UF doesn’t support HEC! When you want to use HEC, the instance must be full splunk enterprise like heavy forwarder.

r. Ismo