#Splunk http event collector example update#

1 indicates HTTPS is enabled 0 indicates HTTP. Whether the HTTP Event Collector server protocol is HTTP or HTTPS. When set to 1 in the stanza, this parameter disables all tokens. The value of this parameter must never be more than the number of physical CPU cores on your Splunk Enterprise server. Do not alter this setting unless you are requested to do so by Splunk Support.

The number of dispatcher threads on the HTTP Event Collector server.

#Splunk http event collector example update#

To set the HTTP queue size globally, update nf using the following case-sensitive setting: The stanza contains global settings that apply to all tokens. The nf file contains basic explanatory information about each setting. Settings specified here override settings specified within the stanza.

The stanzas, where token_name indicates the token name as assigned by the user, apply to individual tokens.

The stanza contains global settings that apply to all tokens.

You can specify whether settings apply globally to all tokens or only to specific tokens: HEC stores settings related to token management in the nf configuration file.

Restart Splunk Enterprise for the changes to take effect.

The HEC token must be a Globally Unique IDentifier (GUID).

Specify global and token settings as described in Token-related settings later in this topic.

Use a text editor to open nf for editing.

Create an nf file if it does not exist.

Change to the $SPLUNK_HOME/etc/apps/splunk_httpinput/local directory.

In the $SPLUNK_HOME/etc/apps/splunk_httpinput directory, create a local directory, if it does not exist.

To set up HEC with configuration files, follow these steps: See Configuration file precedence in the Admin Manual. No matter how many nf files a Splunk Enterprise instance has and where they reside, Splunk Enterprise combines all their settings, using the rules of location precedence. For HEC, you edit the files in the $SPLUNK_HOME/etc/apps/splunk_httpinput/local/ directory. In many cases, you edit the files in the $SPLUNK_HOME/etc/system/local directory. These files are not accessible on Splunk Cloud Platform instances, and you must manage configurations on Splunk Cloud Platform instances through Splunk Web.Ĭonfiguring HEC inputs with a configuration file is a slightly different process than configuring other data inputs. HTTP Event Collector (HEC) stores its settings on a Splunk Enterprise instance in two configuration files: nf and nf. Set up and use HTTP Event Collector with configuration files