Hello. I'm seeing a lot of articles in web searches about turning on https for HEC, but approximately zilch on turning it off. I did find: Whether the HTTP Event Collector server protocol is HTTP or HTTPS. 1 indicates HTTPS is enabled; 0 indicates HTTP. The default value is 1. HTTP Event Collector shares SSL settings with the Splunk Enterprise instance and can't have enableSSL settings that differ from the settings on the Splunk Enterprise instance.   We need HEC to run without TLS, and can live with the Web UI not having TLS too if that'll help with HEC. But if I toss: [http] disabled = 0 enableSSL = 0 ...into /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf and restart splunk, then HEC continues to demand https, and /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf is rewritten automatically to: [http] disabled = 0 enableSSL = 1 What do I need to do to make HEC use http, not https? (We realize that https is more secure.  For our production splunk we'll use https, but for our team's development environments it just makes more sense to use http.  I've not discussed why, but I suspect https is proxied somehow)  Thanks! ... View more

  Hi folks. I posted here recently exploring how to automatically add an index when docker-compose is bringing up the splunk container.  That post is at https://forums.docker.com/t/add-an-entrypoint-and-command-without-messing-up-the-invocation/123686 I had it working, but it no longer does, and I somewhat-suspect a docker volume problem as well as somewhat-suspect a permissions issue, and also somewhat suspect an OS upgrade.  But I really don't know what the problem is. Inside the splunk container, I see: [root@splunk splunk]# cat /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf [http] disabled = 0 [http://splunk_hec_token] disabled = 0 token = really-big-token-thingie Which is really not what I want. And outside the splunk container (on the MacOS side), I see: $ cat splunk-files/opt-splunk-etc-apps-splunk_httpinput-local/inputs.conf cmd output started 2022 Mon May 02 04:19:43 PM PDT [http] disabled = 0 [http://splunk_hec_token] disabled = 0 token = really-big-token-thingie index = dev_game-publishing That is what I want. In my docker-compose, I have (among other things) : volumes: - ./splunk-files/opt-splunk-etc-apps-splunk_httpinput-local/ /opt/splunk/etc/apps/splunk_httpinput/local/ (That long volume line is all-one-line.  It may or may not be wrapping when you view it, though it is wrapping in this editor) I tried both setting up a volume for the entire directory, as well as just that one file.    I'm hearing that doing an entire directory tends to be more reliable, but both failed the same way. The directory containing the file is owned by splunk and has restrictive permissions: [ansible@splunk splunk]$ cat /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf cat: /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf: Permission denied [ansible@splunk splunk]$ ls -l /opt/splunk/etc/apps/splunk_httpinput/ total 12 drwxr-xr-x 2 splunk splunk 4096 Jan 15 03:31 default drwx------ 2 splunk splunk 4096 May 2 22:14 local drwx------ 2 splunk splunk 4096 May 2 22:14 metadata [ansible@splunk splunk]$ Which explains why the ansible user can't cat it.  But is ansible painting itself into a corner and preventing itself from making all the changes I need? I also upgraded from MacOS 11.x to 12.3 in between when this was working, and when it stopped.  I don't know if that's related or not. I have next to no Splunk and even less Ansible. Thanks for any and all suggestions! ... View more

  Hi people. I'm attempting to submit an event over HEC to an index called dev_game-publishing. This looks like: curl -k 'https://so1:8088/services/collector/event?index=dev_game-publishing' -H "Authorization: Splunk 11111111-2222-3333-4444-555555555555" -d '{"event": "hello world unique"}'; echo {"text":"Success","code":0} Or: curl -k 'https://so1:8088/services/collector/event' -H "Authorization: Splunk 11111111-2222-3333-4444-555555555555" -d '{"event": "hello world unique"}'; echo {"text":"Success","code":0} I've of course changed my token to nonsense. Those "Success" strings sound to me like the submission has worked. However, when I go to Search in the web interface and look for "index=*" (for All time), I see only a small number of my test events, and they're all on the main index.   The token I'm using defaults to the dev_game-publishing index. I believe I'm using a Trial license. What do I need to do to get Splunk to accept events on the dev_game-publishing index? Thanks! ... View more

  Hi folks. I'm attempting to run Splunk in a docker container.  Or rather, I have that working - it was pretty easy with docker-compose based on https://splunk.github.io/docker-splunk/EXAMPLES.html#create-standalone-from-compose However, I want to create an index automatically, when the container first starts up.  This I'm finding difficult. I've tried a variety of methods, but they all failed in one way or another: yum and dnf are missing from the container, and microdnf appears to be broken.  This makes it difficult to customize the container's configuration. The container so configured appears to be based on RHEL, and we don't have any RHEL entitlements.  This too makes it difficult to customize the container's behavior. I tried setting up a volume and adding a script that would start splunk and shortly thereafter add the index, but I found that Splunk was missing lots of config files this way.  This may or may not be due to my relative inexperience with docker. I invoked the script with the following in docker-compose.yml: entrypoint: /bin/bash command: /spunk-files/start   I needed to copy these files, which I didn't have to copy before the entrypoint+command change: $SPLUNK_HOME/etc/splunk-launch.conf $SPLUNK_HOME/etc/splunk.version I also needed to create some logging directories, otherwise Splunk would fail to start. One of my favorite troubleshooting techniques, using a system call tracer like "strace", wasn't working because I couldn't install it - see above under microdnf. Does anyone know of a good way to auto-create a Splunk index at container creation time, without an RHEL entitlement? Thanks!   ... View more