- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"Enable indexer acknowledgement" in "ITSI Event Management Token" causes "Data channel is missing" errors
ahkow2
Loves-to-Learn
10-26-2022
02:43 AM
Hi,
After I ticked "Enable Indexer acknowledgement" in "HTTP Event Collection" -> "Auto Generated ITSI Event Management Token", I no longer have notable events generated. And I saw "Data channel is missing" errors in _internal index.
After some research, I understood from https://docs.splunk.com/Documentation/Splunk/8.2.7/Data/AboutHECIDXAck that HEC sender must include a channel identifier. But how do I configure ITSI so that it include channel identifier when it is generating notable events?
Thank you very much.
