topic Re: Connectivity Issue with Splunk HEC Endpoint in Splunk Cloud Platform

Connectivity Issue with Splunk HEC Endpoint

rake — Thu, 31 Oct 2024 13:26:03 GMT

Hello,

I’m experiencing a connectivity issue when trying to send events to my Splunk HTTP Event Collector (HEC) endpoint. I have confirmed that HEC is enabled, and I am using a valid authorization token.

Here’s the command I am using:

curl -k "https://[your-splunk-instance].splunkcloud.com:8088/services/collector/event" \ -H "Authorization: Splunk [your-token]" \ -H "Content-Type: application/json" \ -d '{"event": "Hello, Splunk!"}'

Unfortunately, I receive the following error:

curl: (28) Failed to connect to [your-splunk-instance].splunkcloud.com port 8088 after [time] ms: Couldn't connect to server

Troubleshooting Steps Taken:

Successful Connection from Another User:

Notably, another user from a different system was able to successfully use the same curl command to reach the same endpoint

Network Connectivity:

I verified network connectivity by using ping and received a timeout for all requests.

I performed a traceroute and found that packets are lost after the second hop.

Despite these efforts, the issue persists. If anyone has encountered a similar issue or has suggestions for further troubleshooting, I would greatly appreciate your help.

Thank you!

Re: Connectivity Issue with Splunk HEC Endpoint

richgalloway — Thu, 31 Oct 2024 15:05:34 GMT

The ping and traceroute checks confirm a lack of connectivity between your system and your Splunk Cloud stack. Check your firewall and/or contact your Network Team.

Re: Connectivity Issue with Splunk HEC Endpoint

isoutamo — Sat, 02 Nov 2024 14:29:16 GMT

it seems that you have wrong cloud HEC endpoint.

You should use https://http-inputs-<your stack>.splunkcloud.com/<endpoint>.

See more here Send data to HTTP Event Collector

There are some differences based on where and which experience your Cloud Stack is/has.

r. Ismo

Re: Connectivity Issue with Splunk HEC Endpoint

jc01480 — Tue, 18 Mar 2025 20:33:12 GMT

Try removing the port number at the end if you are using Splunk Cloud. This was the issue in my case. The documentation does not reflect this issue as of this writing.