topic Re: Enable http event collector in Splunk Cloud Platform

Enable http event collector

eltnegcoinprofi — Sun, 14 Jun 2020 16:49:44 GMT

How can I use the HTTP event collector in Splunk cloud 15 days trial? Also, will my instance be disabled after the trial?

I followed the instructions here but I got {"text": "Data channel is missing", "code":10} and Could not resolve host: when I tried the URLs `https://http-inputs-prd-p-xxxxx.splunkcloud.com:443/services/collector/event` and https://prd-p-xxxxx.splunkcloud.com:8088/services/collector/event respectively.

Re: Enable http event collector

livehybrid — Sun, 14 Jun 2020 21:10:54 GMT

The first request sounds almost right, but the token has Acknowledgement turned on so need to either turn that off or add a request channel (In curl this would be something like

-H "X-Splunk-Request-Channel: FE0ECFAD-13D5-401B-847D-77883AD77131"

Re: Enable http event collector

eltnegcoinprofi — Sun, 14 Jun 2020 21:25:02 GMT

Thanks. Logging now works as expected. What happens when my trial period elapses? Does my instance get erased or will I have reduced logging functionalities?

Re: Enable http event collector

livehybrid — Sun, 14 Jun 2020 21:50:16 GMT

Unfortunately I think you will lose access to it. It may be worth speaking to the sales team to see if it can be extended?

Glad its working!

Re: Enable http event collector

eltnegcoinprofi — Sun, 14 Jun 2020 22:03:41 GMT

Thanks.🙂