topic Re: How to resolve Error sending events to a custom index in Splunk Cloud Platform

How to resolve an error sending events to a custom index?

msilva — Thu, 21 Jul 2022 14:38:55 GMT

Hi,

We have created a custom events index 'abcde' in Splunk Enterprise, but sending data to it with cURL always fail. If the index is 'main', it works fine.

Could you please investigate this issue?

Kind regards,

Moacir

Re: How to resolve Error sending events to a custom index

richgalloway — Thu, 21 Jul 2022 14:15:31 GMT

How did you create the index? On which instance was it created?

How does curl fail? What error is returned?

Re: How to resolve Error sending events to a custom index

msilva — Thu, 21 Jul 2022 14:56:01 GMT

Hi,

I have forgotten to add it to "Select Allowed Indexes" in the HEC token. Now it works fine 🙂

Thanks,

Moacir