Getting Data In

Is there a way to set up an HTTP event collector specific to a Splunk App?

diliptmonson
Explorer

Is there a way to create an HTTP event collector specific to a Splunk app? I have multiple apps within my Splunk Cloud and would like to create an event collector which is specific to an app. Any suggestions on how to get this done?

0 Karma

shaskell_splunk
Splunk Employee
Splunk Employee

The default configs for the HTTP Event Collector are included within the following app.

$SPLUNK_HOME/etc/apps/splunk_httpinput

Any new input created through the UI is placed in the local directory of this app and can be managed through the REST API.

You can define http inputs within the scope of any app but they can not be managed (enabled, disabled) via the REST API. This is by design. Including http inputs within custom apps is not a recommended best practice approach even though it will work.

0 Karma

lpolo
Motivator

Under "$SPLUNK_HOME/etc/apps/splunk_httpinput" is where the outputs.conf will be placed so all http events will be forwarded to splunk indexers?

Thanks,
Lp

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...