Why am I receiving the following error "WARNING: web interface does not seem to be available!" when pushing HTTP Event Collector(HEC) configurations to Heavy Forwarders (HF)?

[sylim_splunk]

After HEC configurations are pushed to our HF, Splunk service fails to start.

This is happening to all the HF that received the new HEC configurations.

[sylim_splunk · Accepted solution]

There is a known issue in this regards - if there are any duplicate tokens for HEC in search/local/inputs.conf the splunkd/splunkweb will fail to start and puts log message on the screen.

WARNING: web interface does not seem to be available!

• Run to find the duplicate token in inputs.conf
  

$ splunk btool --debug inputs list | grep "token =" | cut -d "=" -f 2 |sort |uniq -c | awk '{ if ($1 > 1) print $2}'

• The fix has been included in 7.0.6+ and 7.1.3+.