Splunk Enterprise

HEC Introspection Debug not working

lavster
Loves-to-Learn

Hello, we are trying to diagnose a parsing error from AWS Firehose to Splunk using HEC. The endpoint is configured properly but we are getting "no data" parsing errors. To try and debug this I have switched DEBUG on for httpeventcollector on the heavy forwarder receiving the data. However the introspection log is still only showing INFO.  Am i setting debug in the wrong place? or has anyone else overcome this?

Labels (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!