Events sent via HEC don't get indexed by indexer

Available Languages

Updated:September 29, 2026
Document ID:SPLK046252

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

This is the error seen by the user:

03-16-2021 03:31:43.334 +0000 ERROR HttpInputDataHandler - Parsing error : Incorrect index, 
index='prod_index'

Investigation

The following HEC token set on their indexer:

$ vi etc/slave-apps/splunk_httpinput/local/inputs.conf
[http://docee_nonprod_logs]
description = Created for nonprod logs
disabled = 0
index = prod_index
indexes = prod_index


As the HEC token already has indexes associated with the token, with regard to the error entries, the possibility might be that the HEC client is trying to use a invalid combination of HEC and index in its payload (For example: using HEC token for index "A", but trying to send events to index "B") and from the log, in this case the HEC client was trying to use HEC token for "prod_index" but sending events to index "dev_index":
 

03-16-2021 03:09:38.569 +0000 ERROR HttpInputDataHandler - Failed processing http input, token 
name=prod_index, channel=n/a, source_IP=10.10.10.1, reply=7, events_processed=1, 
http_input_body_size=7497503-16-2021 03:09:38.569 +0000 ERROR HttpInputDataHandler - Parsing error : Incorrect index, 
index='dev_index'
 

Resolution

Double check and confirm your HEC clients' settings to ensure it is correctly configured with right the combination of HEC token and index name.
 
Splunk Documentation:
Set up and use HTTP Event Collector in Splunk Web
 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products