Getting Data In

Splunk HEC closes connection instead of re-using it

onlineops
Explorer

Our apps send data to the Splunk HEC via HTTP POSTS. The apps are configured to use a connection pool, but after sending data to Splunk (via HTTP POSTS), the Splunk server responds with a Status 200 and the "Connection: Close" header. This instructs our apps to close their connection instead of reusing the connection.

How can I stop this behavior? Right now it's constantly re-creating a connection thousands of times instead of just re-using the same connection.

Labels (2)
0 Karma
1 Solution

onlineops
Explorer

To fix this issue, we had our client insert the "Connection: Keep-Alive" header into the HTTP POST requests. This instructed the Splunk server to keep the connection alive.

View solution in original post

onlineops
Explorer

To fix this issue, we had our client insert the "Connection: Keep-Alive" header into the HTTP POST requests. This instructed the Splunk server to keep the connection alive.

PickleRick
SplunkTrust
SplunkTrust

Interesting find. It's inconsistent with the docs so it calls for a support case or at least a docs feedback.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Are your clients sending proper HTTP/1.1. Splunk should support keep-alive out of the box.

0 Karma

onlineops
Explorer

Thank you for replying. Yes, the client is using HTTP 1.1 when sending the HTTP POSTS. This was verified within the packet capture.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well, this says that Splunk should normally behave properly with HTTP/1.1

https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector#Detect_scali...

Another thing to consider.

forceHttp10 = [auto|never|always]
* Whether or not the REST HTTP server forces clients that connect
  to it to use the HTTP 1.0 specification for web communications.
* When set to "always", the REST HTTP server does not use some
  HTTP 1.1 features such as persistent connections or chunked
  transfer encoding.
* When set to "auto", it does this only if the client did not send
  a User-Agent header, or if the user agent is known to have bugs
  in its support of HTTP/1.1.
* When set to "never" it always allows HTTP 1.1, even to
  clients it suspects might be buggy.
* Default: auto
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...