On a Linux host I am testing our HEC IndexerAcknowledgement setup on our heavy forwarder and following the documentation example but I keep running into "invalid data format" errors. I am r...
Hi Experts,
I configured HEC input, after that I run curl command using that token, it returns {"text":"Success","code":0} .
But no event comes into my INDEX.
Any suggestions on how to p...
Hello fellow Splunkers,
I need some help with HEC (HTTPEventCollector). The problem is that no events are appearing in any indexes. To simplify the issue I set up a test HEC config without SSL (http...
As I want to use the same HTTPeventcollector (HEC) token, can i add the new index=X and remove old index=Y? But, I don't want to lose the events on old index=Y. So, if i do that, the events on Index...
We think that the HTTPEventCollector reaches directly the indexing queue when using the event end point. Meaning the props.conf that we place are being ignored. Is this right?
I have three stand alone indexers in a round robin and want them to accept HTTPevents via the HTTPEventCollector. How do I generate a token with the same value on all three?
Hello,
We have a Splunk Enterprise environment that has separate tiers that are clustered; Search Heads and Indexers. Where/which tier do I enable HEC on and create tokens? Search Heads or Indexer...
Hi,
I just downloaded and installed Splunk Light on-prem and I'm trying to use HTTPEventCollector walk-through ( http://dev.splunk.com/view/event-collector/SP-CAAAE7F) with postman/curl. I t...
...nybody else has had this issue with the HTTPEventCollector? Is there a more efficient way of indexing data so this doesn't happen? Is a TCP socket faster than the HEC?
I am currently waiting f...
I have an application which send event to HTTPeventcollector and writes a backup log to disk.
Can I somehow configure Splunk to index a log file, incase HTTP endpoint will be unavailable?
H...