[DB Connect v3.16] Parsing_err="No data" HEC Error in DB Connect App

Applicability

Description

An issue was observed where the following HEC error appeared in internal logs, even though the data inputs configured in the DB Connect app were working as expected:

01-15-2025 13:53:01.107 +0000 ERROR HttpInputDataHandler [1557509 HttpDedicatedIoThread-1] - Failed processing http input, token name=db-connect-http-input, channel=n/a, source_IP=127.0.0.1, reply=5, events_processed=0, http_input_body_size=0, parsing_err="No data"

Investigation

To find out this HEC error from internal logs, run the below SPL query:

index=_internal *HttpInputDataHandler* log_level=ERROR

Filter out the results to get the below error:

01-15-2025 13:53:01.107 +0000 ERROR HttpInputDataHandler [1557509 HttpDedicatedIoThread-1] - Failed processing http input, token name=db-connect-http-input, channel=n/a, source_IP=127.0.0.1, reply=5, events_processed=0, http_input_body_size=0, parsing_err="No data"

Further investigation revealed that DB Connect App version 3.16 uses a Round Robin load balancing strategy when sending data through HEC. As part of this process, an empty event is sent to validate the URL and HEC token. This behavior causes the HttpInputDataHandler to log the error message, even though it does not indicate an actual failure in data ingestion.

However, in DB Connect App version 3.17 or later, the HEC validation method has been improved to prevent these error messages from appearing in logs.

Resolution

To eliminate these error messages, upgrade the DB Connect App to version 3.17 or later.

If upgrading is not immediately possible, these error messages can be safely ignored as they do not impact data ingestion functionality.