无法从AWS Kinesis Firehose通过HEC在Splunk Cloud中接收事件。

适用范围

描述

"If you have a proxy (ELB or other) between Kinesis Firehose and the HEC node, you must enable sticky sessions and not provide any session expiration to support HEC ACKs"

调查

如何识别：

1)AWS中可能会出现如下错误：

{
"deliveryStreamARN": "arn:aws:firehose:ap-southeast-2:406119630047:deliverystream/wagering-ivr-UATYarraBaseline-wivr-logs-kinesis-firehose",
"destination": "https://http-inputs-ack-xxxx.splunkcloud.com/services/collector/raw",
"deliveryStreamVersionId": 1,
"message": "If you have a proxy (ELB or other) between Kinesis Firehose and the HEC node, you must enable sticky sessions and not provide any session 
expiration to support HEC ACKs.",
"errorCode": "Splunk.ProxyWithoutStickySessions",
"processor": "arn:aws:lambda:ap-southeast-2:406119630047:function:paism-log-processor"
}

2)如果您尝试使用下面的命令将测试事件发送到HEC令牌，则会收到错误消息

{"text":"Data channel is missing","code":10}

curl -k "https://http-inputs-<stack-id>.splunkcloud.com/services/collector" -H "Authorization: Splunk BD274822-96AA-4DA6-90EC-18940FB2414C" -d 
'{"event": "Hello, world!", "sourcetype": "manual"}' 

分辨率

如何修复：

要修复此问题，请转至设置(Settings)“数据输入”(Data Inputs)“HTTP事件收集器(HTTP Event Collector)，然后在出现问题的令牌上点击“编辑”(edit)，取消选中“启用索引器确认”(Enable indexer acknowledgement)，然后单击“保存”(Save)

如果收到错误{"text":"数据通道缺失","code":10} 而且不从AWS Kinesis Firehose发送事件，而是使用curl命令，并且您希望保持索引器确认处于启用状态，然后只需向命令添加一个通道，例如：

curl https://http-inputs-<stack-id>.splunkcloud.com/services/collector?channel=FE0ECFAD-13D5-401B-847D-77833BD77131 -H "Authorization: Splunk 
BD274822-96AA-4DA6-90EC-18940FB2414C" -d '{"event": "Hello, world!", "sourcetype": "manual"}' -v

相关链接