Getting Data In

Unable to see the log data in indexer read by HTTP Event Collector post reinstallation of Splunk package

santosh_hb
Explorer

Hi All,

Need a quick help on the below issue.

  • We had configured HTTP Event Collector to read Netflow logs on port 8088 on Splunk HF. (Splunk version was 7.2.1)
  • Token was generated and it was added on External Logger and was authenticated to connect to Splunk HF.
  • Now, for some reason we have stopped the Splunk on HF and reinstalled Splunk 7.1.6 on the same HF.
  • HTTP Event Collector configs are copied from previous configurations along with Token value.
  • Now, the data has stopped flowing into Indexer post this change.
  • Tried to check all the HTTP EVent Collector debug techniques but unable to understand the issue.
  • I even can't see any errors in internal logs coming from HF

I doubt the issue might be with Token that was created earlier. Do I need to recreate the HTTP token and reconfigure it.

Awaiting for your help.
regards,
Santosh

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@santosh_hb,

Yes, each token has a unique value, which is a 128-bit number that is represented as a 32-character globally unique identifier (GUID). You have to create new token after enabling HEC as described in Configure HTTP Event Collector on Splunk Enterprise in the new installation.

Happy Splunking!
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@santosh_hb,
Check below configuration if all looks good then re-create the token and use that. (As you have changed Splunk version re-creation of token is probably require)

  • In Global Settings > All Tokens is enabled.
  • Port is 8088 only.
  • Enable SSL is set to proper value that you are using on sender side.
  • Your token is enabled.

Hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...