topic Re: HEC failed to connect to port 8088 in Splunk Enterprise

HEC failed to connect to port 8088

jip31 — Tue, 24 Oct 2023 15:20:04 GMT

My Splunk server is reachable from :

http://127.0.0.1:8000/fr-FR/app/launcher/home

I try to send data in my splunk server with the curl command below

curl -H "Authorization: Splunk 1f5de11f-ee8e-48df-b4f1-eb1bbb6f3db0" https://localhost:8088/services/collector/event -d '{"event":"hello world"}'

But I have the message : curl: (7) Failed to connect to localhost port 8088 after 2629 ms: Couldn't connect to server

Could you help please?

Re: HEC failed to connect to port 8088

PickleRick — Tue, 24 Oct 2023 15:35:12 GMT

The message says it all - your curl sent SYN packets but never got any reply.

Which means that even if your port is open, it's probably filtered by your local firewall (since you're connecting to loopback device it can't be anything on external network). Check your iptables/firewalld config and open that port so that you can connect.

Whether the port is open by Splunk is another question and you'll see as soon as you "poke a hole" in your firewall.

Re: HEC failed to connect to port 8088

jip31 — Wed, 01 Nov 2023 11:09:50 GMT

I have opened the port 8088 in Windows Defender but the result is the same

Is anybody have an idea?

Re: HEC failed to connect to port 8088

PickleRick — Wed, 25 Oct 2023 21:07:11 GMT

Ahhh... so it's windows.

Ok, firstly check if your port is open. You can do that with netstat command from cmd or powershell. I don't remember the right switches to list listening ports for windows version though.

Anyway, if the port was closed, you should get a connection rejected error, not a timeout.

Re: HEC failed to connect to port 8088

jip31 — Thu, 26 Oct 2023 16:16:01 GMT

It's strange because i have opened the port 8088 correctly in Windows Defender but when i am running the netstat command i can see it opened....