topic Re: Splunk HEC http request not working in Splunk Enterprise

Splunk HEC http request not working

sdkp03 — Wed, 25 Sep 2024 07:02:24 GMT

Splunk HEC was configured as defined in the documentation. I could see that I can send data using https URL. When sending same data using HTTP URL - request is failing with the error "curl: (56) Recv failure: Connection reset by peer".

curl https://<host>:<port>/services/collector -H 'Authorisation: Splunk <token>' -d '{"sourcetype": "demo", "event": "Test data!"}'

OUTPUT/Response : {"text":"Success","code":0}

curl http://<host>:<port>/services/collector -H 'Authorisation: Splunk <token>' -d '{"sourcetype": "demo", "event": "Test data!"}'

curl: (56) Recv failure: Connection reset by peer

This was the command used to enable token /opt/splunk/bin/splunk http-event-collector enable -name <hec_name> -uri https://localhost:8089
which worked perfectly fine

thought I had to enable http URL and executed below command:

/opt/splunk/bin/splunk http-event-collector enable -name catania-app-stat -uri http://localhost:8089
Error/Output : Cannot connect Splunk server

What am I missing here. How do I get source to send data over HTTP protocol.

Re: Splunk HEC http request not working

Jawahir — Wed, 25 Sep 2024 15:40:25 GMT

By default HEC is running on HTTPS. If you really want to disable SSL then you can change it by doing the below

- In Splunk UI Goto -> Settings -> Data Inputs -> HTTP Event Collector

- Click on "Global Settings" Button and uncheck the "Enable SSL" Option

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

Re: Splunk HEC http request not working

dural_yyz — Wed, 25 Sep 2024 15:06:34 GMT

Please don't every disable SSL for HTTP Event Collection - this is purely from a security stand point.

If you absolutely must have an HTTP only connection please setup a separate HF for this purpose. Never expose your indexing tier to non-SSL connections.

Re: Splunk HEC http request not working

sdkp03 — Wed, 25 Sep 2024 23:41:21 GMT

So this is a global setting and I cannot choose protocol per token is it?

Re: Splunk HEC http request not working

sdkp03 — Wed, 25 Sep 2024 23:45:39 GMT

thanks @dural_yyz . I was thinking of a solution where for a specific token I could enable HTTP protocol. I infer based on your comment and @Jawahir comment, I infer that its a global setting and cannot be changed for a specific token. I wonder why Splunk recommends to use HTTP for performance optimisation(referring to below statement from listed ref link).

Sending data over HTTP results in a significant performance improvement compared to sending data over HTTPS.

Troubleshoot HTTP Event Collector - Splunk Documentation

Re: Splunk HEC http request not working

PickleRick — Thu, 26 Sep 2024 09:05:34 GMT

Think layers. HTTP vs. HTTPS is something that happens before even any HTTP request is being sent so it's enabled on a whole network port level and all HEC tokens are serviced by either HTTP or HTTPS input.

Whether HTTP/HTTPS issue is important for you security-wise depends on your approach to the data you're ingesting - is it highly confidential and anyone eavesdropping into it on the wire is a great concern to you or not.

While Splunk states that switching from HTTPS to HTTP can give a significant performance boost I'd be cautious with such general statements. It does depend on the hardware you're using and the volume of data you're processing. If you have a fairly modern server or a properly specced VM and you're not processing some humongous amounts of data you should be fairly ok with HTTPS enabled.

Re: Splunk HEC http request not working

dural_yyz — Thu, 26 Sep 2024 14:02:20 GMT

My background is network engineering so I can't speak to any specific software processing benefits of HTTP vs HTTPS. However, since HTTP is essentially plain text that would be fairly simple to take the packet off the wire. Having to decrypt HTTPS would by the very nature of an additional step add processing requirements but as pointed out by others depending upon the compute power of your server(s) there usually isn't a noticeable hit or queuing of data. Most systems today have compute that will outperform the physical network connection.