Search

qf · ‎11-30-2020

On a Linux host I am testing our HEC Indexer Acknowledgement setup on our heavy forwarder and following the documentation example but I keep running into "invalid data format" errors. I am r...

patng_nw · ‎07-27-2021

I am trying to set up HEC for my indexer cluster (v8.0.7), with 2 indexers (and 3 search heads) managed by a master node. I read multiple docs and articles already, but I want to make sure I get s...

arun_kant_sharm · ‎06-24-2019

Hi Experts, I configured HEC input, after that I run curl command using that token, it returns {"text":"Success","code":0} . But no event comes into my INDEX. Any suggestions on how to p...

sim_tcr · ‎01-18-2018

...o enable HTTP Event Collection on these indexers. I am referring documentation http://dev.splunk.com/view/event-collector/SP-CAAAE73 and it says, Note: Using HTTP Event Collector in a distributed d...

NickLaurent · ‎04-27-2017

Hello fellow Splunkers, I need some help with HEC (HTTP Event Collector). The problem is that no events are appearing in any indexes. To simplify the issue I set up a test HEC config without SSL (http...

otryshko · ‎04-10-2016

Hi, I just downloaded and installed Splunk Light on-prem and I'm trying to use HTTP Event Collector walk-through ( http://dev.splunk.com/view/event-collector/SP-CAAAE7F) with postman/curl. I t...

ddrillic · ‎05-03-2019

We think that the HTTP Event Collector reaches directly the indexing queue when using the event end point. Meaning the props.conf that we place are being ignored. Is this right?

ahmed23 · ‎01-08-2019

As I want to use the same HTTP event collector (HEC) token, can i add the new index=X and remove old index=Y? But, I don't want to lose the events on old index=Y. So, if i do that, the events on Index...

johnpof · ‎10-01-2015

I have three stand alone indexers in a round robin and want them to accept HTTP events via the HTTP Event Collector. How do I generate a token with the same value on all three?

Amandeepsin · ‎05-09-2018

I can see http_event_collector_metrics.log logs under $SPLUNK_HOME/var/log/introspection/splunk/ But splunk says latest event received was 2 days ago. Whats going wrong in http event collector...

Search

Search

Search the Community

HTTP Event Collector Indexer Acknowledgment Return...

Setting up HEC (HTTP Event Collector) in a indexer...

Http Event Collector output not being indexed?

HTTP Event Collector and splunk index cluster

Why are HTTP Event Collector events not appearing ...

Why am I getting error "Data channel is missing" u...

Does the HTTP Event Collector reach the indexing q...

Can you help me replace the Index for an existing ...

How do I create the same HTTP event collector toke...

I can see data in logs but not in index for http e...