Splunk HEC Destination isn't working, data channel is missing

I have a Splunk HEC Destination configured, and data is not flowing.
When looking at the related logs, I see the following:

channel: output:splunk_cloud_hec
cid: w2
level: error message: Request failed
reason: Received status code=400, method=POST, url=https://http-inputs-paddyspub.splunkcloud.com/services/collector/event
response: {“text”:“Data channel is missing”,“code”:10}
time: 2023-02-14T15:26:03.413Z

What am I missing?

We receive the Data channel is missing error message due to the Splunk token having Enable Indexer Acknowledgement set. With it enabled, Splunk expects a Channel ID to be passed in as part of the request. To address the issue, disable that setting for the tokens used within Stream for Splunk HEC Destinations.

From Splunk’s HEC doc regarding this setting.

If the token with which you’re authenticating to HTTP Event Collector has indexer acknowledgement enabled, you must also include the channel identifier with your indexer status query.

Splunk Token modal

1 UpGoat