topic Re: How to decrease local security settings on my local Splunk instance to receive data from another application? in Splunk Enterprise

How to decrease local security settings on my local Splunk instance to receive data from another application?

arajesh456 — Wed, 19 Oct 2016 21:34:32 GMT

I installed Splunk 6.4.4 in my local host.
I am trying to use Splunk only for Data Push & Retrieval operation.

I have another application "X" (which generates data) and provided with Splunk extension with Service called "SendEvent", "Search".

When I try to use SendEvent service to push data to my local Splunk, it gives error as "Unable to invoke service".

"X" application uses SSL.

This means some local hosted Splunk security setting is blocking the request.

So could you please tell me how to decrease local security settings in order to receive data from another application?

Re: How to decrease local security settings on my local Splunk instance to receive data from another application?

ppablo — Wed, 19 Oct 2016 21:55:49 GMT

Hi @arajesh456

Did you mean to put Splunk "4.4"? What version are you referring to exactly?

Re: How to decrease local security settings on my local Splunk instance to receive data from another application?

arajesh456 — Wed, 19 Oct 2016 23:20:32 GMT

Sorry... I am using Splunk 6.4.4

Re: How to decrease local security settings on my local Splunk instance to receive data from another application?

arajesh456 — Thu, 20 Oct 2016 15:48:11 GMT

How Splunk can be integrated with other application to store data & query data?
can Splunk instance be reachable through : Server Name, Port, authenticated Admin user name, password and provide method to push data? through Http / SSL.
and also if anyone can help here to provide the name of Method/Functionality to push data to Splunk instance from outside apps? is it "Add Data"?

Thanks.

Re: How to decrease local security settings on my local Splunk instance to receive data from another application?

dkoshe_splunk — Mon, 24 Oct 2016 01:10:12 GMT

Hello arajesh456,

Have you looked at HTTP Event Collector ?
Although the article talks about Splunk Enterprise, it works perfectly fine with Splunk Light as well.

Also, other ways of getting data from external applications are to setup a universal forwarder on the host where application is potentially writing logs (if that's the case), and having forwarder monitor the folder where log files are and forward it to Splunk Light instance. You can read information about it here.
-Dhananjay

Re: How to decrease local security settings on my local Splunk instance to receive data from another application?

msmith4 — Mon, 07 Nov 2016 08:22:44 GMT

you may consider using something like fiddler or burp, if debugging local SSL connections can help you find the details of the issue and the exact error message.