Getting Data In

Index has empty data when using HEC

malikperang
Loves-to-Learn Everything

Hello 

I need an urgent help.

I created HEC data inputs. I did follow these guidelines.
https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/HECExamples

https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/UsetheHTTPEventCollector

The test was success and I'm able to get 

{"text": "Success", "code": 0}

However, the index was still empty which I'm expecting it should contains the message data.

What would be the reason?

Our Splunk Deployment is like below

1 Searchead Instance

2 Indexer Instance

4 Forwarder Instance.

 

I created the HEC on Searchead via GUI.

 

Please help to advice and thanks in advance

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

HEC should be installed on indexers rather than search heads.  HEC on SH may work if data is forwarded to the indexers, but I've never seen it done that way.

How are you looking for the data?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

malikperang
Loves-to-Learn Everything

@richgalloway I just create the HEC on Indexer.  Success on sending data via HTTP collector but however, when I go to Monitoring Conolse > Indexing > Inputs > HTTP Event Collector: Instance , it's returns "You currently have no tokens configured" . I'm not sure how to fix this.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
When you said forwarder are you meaning UF or HF? In which instance you are sending those HEC messages?
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's possible the MC is not aware of HEC tokens on indexers.  Test that by running the following command on one of the indexers.  It should return your HEC token.

curl -k -u admin:changeme https://localhost:8089/servicesNS/admin/splunk_httpinput/data/inputs/http
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!