I would like to setup HEC but do not see the option under Settings -> Data Inputs. What do I have to do to enable HEC? The server I am trying to configure this on is the indexer, not clustered but set up to do a distributed search.
I see it in mine. Do you have the "splunk_httpinput" app in etc/apps?
Yes it is there. Here is what is in the inputs.conf:
[http]
disabled=1
port=8088
enableSSL=1
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0
sslVersions=*,-ssl2
allowSslCompression=true
allowSslRenegotiation=true
NOTE: Disabled was set to 0, I changed to 1 but made no difference.