topic Re: Why getting timeout error while adding data to the Splunk cloud index from REST API? in Splunk Cloud Platform

Why getting timeout error while adding data to the Splunk cloud index from REST API?

krishnabv — Tue, 28 Jun 2022 17:08:52 GMT

Hello Team,

I am getting timeout error while adding data to Splunk cloud index from REST API. I am using below endpoint. (or) help me how can i add data to Splunk cloud index through REST API's.

URL : http://*********:8088/services/collector

Thanks,
Venkata.

Re: Getting timeout error while adding data to the Splunk cloud index from REST API

isoutamo — Tue, 28 Jun 2022 11:04:38 GMT

did this help you https://community.splunk.com/t5/Getting-Data-In/HEC-troubleshooting-in-distributed-Enterprise-environment/m-p/556758 ?

If there is still timeout you should use curl -v to see verbose logging. And if/when needed ask Splunk Support to enable HEC on your stack if it haven't enabled yet.

r. Ismo

Re: Why getting timeout error while adding data to the Splunk cloud index from REST API?

Roy_9 — Tue, 28 Jun 2022 21:24:24 GMT

Hi @krishnabv

Can you share the url syntax with some dummy names to just understand the format that you are using?

Splunk cloud HEC end point varies for both self and managed service cloud, just wanted to make sure.

Thanks

Re: Getting timeout error while adding data to the Splunk cloud index from REST API

krishnabv — Wed, 29 Jun 2022 06:49:03 GMT

Hi @isoutamo

How can i check whether HTTP event collector is enabled or not in Splunk cloud.

Thanks,
Venkata

Re: Why getting timeout error while adding data to the Splunk cloud index from REST API?

krishnabv — Wed, 29 Jun 2022 07:26:43 GMT

Hi @Roy_9

i am using this URL : http://*********:8088/services/collector

Thanks,
Venkata

Re: Getting timeout error while adding data to the Splunk cloud index from REST API

krishnabv — Wed, 29 Jun 2022 09:14:18 GMT

Hi @isoutamo ,

I am trying below and it is working fine in splunk enterprise and it is not working in Splunk cloud. could you help me on this.

Thanks,
Venkata

Re: Why getting timeout error while adding data to the Splunk cloud index from REST API?

isoutamo — Wed, 29 Jun 2022 09:15:46 GMT

This should works also with SC with correct host part in URL.

curl -vk -u "x:aea66351-b931-4be1-83fa-2787781f501f" https://localhost:8088/services/collector/event -d '{"sourcetype": "mysourcetype", "event": "Hello, world!"}'

You should also see this https://www.aplura.com/assets/pdf/hec_pipelines.pdf to understanding how events are managed based on used endpoint. There are also a newer version of this picture, but I don't know if it's a public or not? @dshpritz knows the situation of it and maybe he could tell when it can published?

Aplura has some other excellent Cheat Sheets for us! Thanks @dshpritz & co!

Re: Why getting timeout error while adding data to the Splunk cloud index from REST API?

krishnabv — Wed, 29 Jun 2022 09:22:13 GMT

Hi @isoutamo ,

i am testing from POSTMAN(Which is 3rd party app), does it work.

Thanks,
Venkata.