topic Re: HTTP event collector issue in Splunk Enterprise

How to resolve HTTP event collector issue?

uagraw01 — Wed, 05 Apr 2023 16:52:18 GMT

Hello Splunkers!!

I want to setup HEC token mechnaism. But After send some events to Splunk by using curl script. I am getting an error "{"text":"The requested URL was not found on this server.","code":404}" . Please help me to fix this issue.

default port 8088 is setup

token is also setup

Thanks in advance

Re: HTTP event collector issue

ITWhisperer — Wed, 05 Apr 2023 07:08:15 GMT

Try /services/collector/event

Re: HTTP event collector issue

uagraw01 — Wed, 05 Apr 2023 07:46:20 GMT

@ITWhisperer I already tried but this, but not working

Re: HTTP event collector issue

PickleRick — Wed, 05 Apr 2023 07:54:56 GMT

Don't put a slash at the end of the URL.

Re: HTTP event collector issue

uagraw01 — Wed, 05 Apr 2023 08:22:18 GMT

@PickleRick >curl -k http://127.0.0.1:8088/services/collector/event
{"text":"The requested URL was not found on this server.","code":404}
[IHT004][WALVAU-AGV-1][05-04-2023 8:21:11][C:\Users\viadmin]
>

I am getting the same error.

Re: HTTP event collector issue

PickleRick — Thu, 06 Apr 2023 08:07:24 GMT

OK. So your Splunk server is running on Windows? And you did the HEC configuration how?

Re: HTTP event collector issue

uagraw01 — Thu, 06 Apr 2023 08:31:25 GMT

@PickleRick I got the issue and fix it.

workaround : I installed the curl agent and setup the required environmental variable and after that it works fine.

Re: HTTP event collector issue

PickleRick — Thu, 06 Apr 2023 08:39:25 GMT

What do you mean by "curl agent"? And what environmental variable?

Re: HTTP event collector issue

uagraw01 — Mon, 10 Apr 2023 16:36:44 GMT

@PickleRick Actually i disabled ssl from http event collect and used “http” in place of “https”. Forget the curl