I'm running universalforwarder as a service in docker, here is my docker-compose config:
services:
splunkuniversalforwarder:
platform: "linux/amd64"
hostname: splunkuniversalforwarder
image: splunk/universalforwarder:latest
volumes:
- opt-splunk-etc:/opt/splunk/etc
- opt-splunk-var:/opt/splunk/var
- ./splunk/splunkclouduf.spl:/tmp/splunkclouduf.spl
ports:
- "8000:8000"
- "9997:9997"
- "8088:8088"
- "1514:1514"
environment:
- SPLUNK_START_ARGS=--accept-license
- SPLUNK_USER=root
- SPLUNK_ENABLE_LISTEN=9997
- SPLUNK_CMD="/opt/splunkforwarder/bin/splunk install app /tmp/splunkclouduf.spl"
- DEBUG=true
- SPLUNK_PASSWORD=<root password>
- SPLUNK_HEC_TOKEN=<HEC token>
- SPLUNK_HEC_SSL=false
TASK [splunk_universal_forwarder : Setup global HEC] ***************************
fatal: [localhost]: FAILED! => {
"changed": false
}
MSG: POST/services/data/inputs/http/httpadmin********8089{'disabled': '0', 'enableSSL': '0', 'port': '8088', 'serverCert': '', 'sslPassword': ''}NoneNoneNone;;; AND excep_str: No Exception, failed with status code 404: {"text":"The requested URL was not found on this server.","code":404}
I can see no reference to POST/services/data/inputs/http/httpadmin in any Splunk docs 😞
Can anyone shed any light on this please?
While I do agree with @isoutamo that HEC on UF is not supported, it can be configured there. It's just unsupported and everyone pretends it's not there 😉
But more to the point, you're apparently trying to use some compose file which assumes you're working with a full Splunk Enterprise installation. While UF provides some REST API endpoints, it doesn't provide full functionality which is expected.
Hi
if I understand right, you are trying to configure HEC receiver on this node?
Splunk UF doesn’t support HEC! When you want to use HEC, the instance must be full splunk enterprise like heavy forwarder.
r. Ismo