HEC Data from AWS Kinesis Firehose with "No data" error | parsing_err="No data"

Applicability

Splunk Cloud AWS Kinesis Firehose

Description

AWS Kinesis Firehose logs are forwarded to Splunk Cloud via HEC endpoints. Events can be sent to Splunk index successfully, however parsing_err="No data" errors on the splunkd log are observed and raised concern. The errors seem to indicate that no data in the payload was sent to the HEC endpoints. This article addresses the error message and explains further how AWS Kinesis Firehose sends data to Splunk via HEC endpoints. 

Investigation

Check the HttpInputDataHandler in the Splunkd log

index="_internal" sourcetype="splunkd" HttpInputDataHandler

notice the ERROR HttpInputDataHandler with reply=5, a token name, the channel is not n/a and the http_input_body_size is 0

ERROR HttpInputDataHandler [3926 HttpDedicatedIoThread-1] - Failed processing http input, token name=********, channel=F3071618-3DF2-4EF7-9A5E-8BBF2321B412, source_IP=x.x.x.x, reply=5, events_processed=0, http_input_body_size=0, parsing_err="No data"

Resolution

HEC data coming from AWS Firehose follows all the basic HEC and HEC with useACK fundamentals/rules but has a behavior that is different and can be unexpected.

AWS Firehose sends two connections before sending the data.

• First connection is to the collector/health point, basically asking if it’s healthy to receive data.
• Second connection, think of it as a ”I don’t believe you” moment and Firehose tries to connect to the collector endpoint to send the event, with no payload. Payload is the data to submit. It will have a token and a channel, because it’s required by the token, but the connection won’t include any data.
• When it can make that connection and get the 400 code back because there was no data, it finally believes that the indexer is healthy and ready to receive data.
• The last connection contains the token, channel, and the payload.

Notice the reply=5, a token name, the channel is not n/a and the http_input_body_size is 0.

This is the expected behaviour to see the parsing_err="No data" on splunkd logs when AWS Kinesis Firehose is sending data to Splunk Cloud via HEC endpoints. 

Revision History

Revision	Publish Date	Comments
1.0	30-Sep-2026	Initial Release