Hi Team,
Greetings !
I have setup a Splunk on-prem cluster, and data is feed via HEC endpoints.
Here is my HEC token config from inputs.conf
```
[http://IntegrationAckDisabledToken]
disabled = 0
index = integrationindex
indexes =
token = 7XXXX31-58b6-4cf1-XXXXX62d04f
useACK = 0
sourcetype = json_no_timestamp
```
And the I send some data with channel in the header via the /services/collector/raw
And when tried to get the ack using /services/collector/ack as below
I expected HTTP -400 {"text":"ACK is disabled","code":14}
but received HTTP - 200 {"acks":{"1":true}}
I'm wondering why?
One side note is, I initially created the HEC token with useACK =1, via CLI.
Later disabled the ACK, via UI.
Any gurus in this community seen such behavior?
Thanks,
CG