Getting Data In
Highlighted

http event collector looks disabled | no action to enable

New Member

Using Splunk Cloud - After adding first http event collector the status shows disabled, actions do not show a enable link, a greyed out disabled link, monitoring shows no connection attempts,

I tried a manual test but I think I have the endpoint hostname incorrect ?

PS C:\Users\eagle> Invoke-WebRequest -Uri "https://http-inputs-xxxx.splunkcloud.com:443/services/collector/event" -Headers @{'Authorization' = 'Splunk xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx'}

Invoke-WebRequest : The remote name could not be resolved: 'http-inputs-xxxx.splunkcloud.com'

Labels (1)
0 Karma
Highlighted

Re: http event collector looks disabled | no action to enable

SplunkTrust
SplunkTrust

Hi elegantleaf,

the error states The remote name could not be resolved: which points to DNS.

cheers, MuS

Highlighted

Re: http event collector looks disabled | no action to enable

New Member

Thanks I am not sure it's DNS I have tried on other hosts as well, am I even using the correct syntax \ URL and why does the status show disabled without an enable link ? I think I am stuck here

  1. status of http event collector token shows disabled - How do I enable ?
  2. Am I using the correct URL ? - https://http-inputs-prd-p-dpyn3.splunkcloud.com:443/services/collector
0 Karma
Highlighted

Re: http event collector looks disabled | no action to enable

New Member

I am also getting the same issue with my new free 15 day trial account. I created a new HTTP Event Collector and it's stuck in "disabled" status. I can't seem to enable it.

0 Karma
Highlighted

Re: http event collector looks disabled | no action to enable

Path Finder

use this settings in the inputs.conf in the following path :
$SPLUNKHOME\etc\apps\splunkhttpinput\local

[http]
disabled = 0
useDeploymentServer = 1

It will solve the issue. Please let me know once you resolve this issue.

0 Karma
Highlighted

Re: http event collector looks disabled | no action to enable

New Member

Thanks. How do I edit or copy the inputs.conf on Splunk Cloud instance ? Is there anyway to SSH into the Splunk Cloud Enviroment to do this ?

0 Karma
Highlighted

Re: http event collector looks disabled | no action to enable

Path Finder

Hi,

I had this quirk too, its specific to Splunk cloud free trials (15 days).... even though HEC shows as disabled in the UI it will work

also use the endpoint similar too.... https://prd-p-h00lm.splunkcloud.com:8088/services/collector

That should get you there

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.