topic Hostname or end point url of Splunk enterprise instance in Splunk Enterprise

Hostname or end point url of Splunk enterprise instance

Kumar_Gana — Wed, 30 Mar 2022 17:28:42 GMT

Hi Team,

I have recently installed Splunk enterprise free trail in my pc.

Created and hec event collector and hec token.

I want to send some data to my splunk instance from an external client(system).

But my splunk url shows only http://<IPaddress>:<port> using which getting connection refused or invalid server.

Can you please suggest how to get the correct host name and url of my splunk system, so that i can trigger data from my client to splunk

thanks,

Kumar

Re: Hostname or end point url of Splunk enterprise instance

venky1544 — Wed, 30 Mar 2022 14:18:48 GMT

Hi @Kumar_Gana

correct me if i'm wrong as per my understaning

1) are you looking for the IP of your splunk instance ?

if yes then based on your OS win or linux you should run ipconfig or ifconfig to get the ip address

since this is free trail on your system do check for the firewall issue which i don't think should be there

use curl before testing with 3rd party application if using linux it should have by default if using windows please get a curl.exe and test below command

curl -k https://localhost:8088/services/collector -H 'Authorization: Splunk 578254cc-05f5-46b5-957b-910d1400341a' -d ''

It will return something like:

{"test":"No data","code":5}

it will check authentication token is correct and working and also check for the connection whereever you run the command and the hec point

for curl you can use the local host but running from external application use the IP like below

curl -k https://11.11.2222.111:8088/services/collector -H 'Authorization: Splunk 578254cc-05f5-46b5-957b-910d1400341a' -d ''

Hope this helps karma points are appreciated

Re: Hostname or end point url of Splunk enterprise instance

VatsalJagani — Wed, 30 Mar 2022 14:30:31 GMT

If you are making the request from some public server. Then you need to specify your machine's public IP there.

In this scenario, you need to have public IP attached to your PC. You can check this from the below URL after you enable the HEC configuration.

https://www.yougetsignal.com/tools/open-ports/

(with your public IP and HEC port number)

If you do not own the static public IP then use the cloud instance like GCP and AWS to install Splunk as they will provide static public IP to use.

Hope this helps.

Re: Hostname or end point url of Splunk enterprise instance

Kumar_Gana — Wed, 30 Mar 2022 15:45:26 GMT

@VatsalJagani

I clicked on the below given url and i am seeing an IP there saying "your external address".

when i clicked on check by giving hec token port(8088). It is saying that "port 8088" is closed on given external IP.

I am not sure how attach public IP to my PC.

Regarding, GCP or AWS, you mean installing my splunk enterprise instance on AWS? If yes, can you please provide the documentation on how to do it.

Thanks,

Kumar

Re: Hostname or end point url of Splunk enterprise instance

VatsalJagani — Wed, 30 Mar 2022 16:29:33 GMT

That tells me you are not on static public IP.

Use GCP/AWS to create an EC2 Linux/Windows instance. Do SSH/Windows RDP for logging into it.

* https://cloud.google.com/compute/docs/instances/create-start-instance

* https://docs.aws.amazon.com/efs/latest/ug/gs-step-one-create-ec2-resources.html

And then use the regular Linux/Windows Splunk installation guide.

* https://docs.splunk.com/Documentation/Splunk/8.2.5/Installation/InstallonLinux