topic HTTP Event Collector URL in Splunk Cloud Platform

HTTP Event Collector URL

hnfd73hd8sjhDD — Sun, 31 Jan 2021 12:23:30 GMT

Hi,

I'm using the free cloud trial, and none of the URLs suggested within the documentation work.

[HOST]/services/collector throws a 303 error, redirecting to [HOST]/en-GB/services/collector which in turn throws a 404 error.

input-[HOST], inputs-[HOST], http-inputs-[HOST] do not resolve.

inputs.[HOST] resolves, but throws an SSL error as the wildcard cert attached to it does not cover the extra tier in the FQDN.

[HOST]:8088 resolves, but throws an SSL error as the cert attached to it does not match the FQDN (SplunkServerDefaultCert).

Any idea what I should be using?

TIA,
Martin...

Re: HTTP Event Collector URL

scelikok — Tue, 02 Feb 2021 04:52:57 GMT

Hi @hnfd73hd8sjhDD,

According to documentation our should use below URL; (you should replace stackname with yours)

https://stackname.splunkcloud.com:8088/services/collector/event

Re: HTTP Event Collector URL

hnfd73hd8sjhDD — Tue, 02 Feb 2021 07:46:11 GMT

Hi,

Thanks for the reply!

As noted: using that URI throws an SSL error as the certificate doesn't match (the cert returned is a default one, not the one for the stack).

Any other suggestions?

Martin...

Re: HTTP Event Collector URL

scelikok — Tue, 02 Feb 2021 07:55:44 GMT

Hi @hnfd73hd8sjhDD,

I believe Splunk Free Cloud Trail uses self sign certificate. That is why you may need to disable certificate check on your tests.

Re: HTTP Event Collector URL

hnfd73hd8sjhDD — Tue, 02 Feb 2021 11:13:02 GMT

Thanks for your reply.

Is that a definite (have you tried it yourself?)

The problem is that the library I'm using doesn't have the ability to disable SSL validation (it's an intentional choice: if it isn't there as an option, someone can't accidentally make a mistake and push it to a live environment).

If that is the case, then the documentation definitely needs cleaning up, and a note added to this effect (apart from there being contradicting examples in ther same document about which URI to use). 😉

Martin...

Re: HTTP Event Collector URL

scelikok — Tue, 02 Feb 2021 12:17:40 GMT

As far as I know it is self signed for free trial. But this is not a new info.

You can confirm with Splunk support.

Re: HTTP Event Collector URL

hnfd73hd8sjhDD — Tue, 02 Feb 2021 12:20:18 GMT

I've just tried using curl (with verification off) and it works ok (event ends up in the right place).

(thanks for your help).

Seems like a potential bin-fire in the waiting for anyone evaluating Splunk though. Someone now has to remember to re-enable TLS validation if they move from free to cloud/enterprise, otherwise their sensitive log data is accessible by anyone along the network path who wants to MITM the connection.

Martin...