#data channel is missing

[ryanvgates]

Splunk HEC Gotcha

Problem

You’ve got Splunk installed and configured. You setup an HTTP Event Collector(HEC) and its appropriate index(es). You try to use the following to post to it,

but get the following response.

Solution

I was able to correct the issue by switching off the Enable indexer acknowledgement for that HTTP Event Collector Token.

Go to Settings -> Data -> Data Inputs

Click HTTP Event Collector

Fi…

View On WordPress