topic Testing something on my Splunk Free at home using receivers/simple endpoint and all I'm getting is 404 in Getting Data In

Testing something on my Splunk Free at home using receivers/simple endpoint and all I'm getting is 404

PickleRick — Mon, 04 Apr 2022 14:44:16 GMT

I'm kinda lost here.

I'm trying to test something on my Splunk Free at home using receivers/simple endpoint and all I'm getting is 404.

The "normal" HEC endpoints work OK.

$ curl "http://172.16.0.3:8088/services/receivers/simple?source=www&sourcetype=web_event" -d "aaaaaaaaaaaaaa"
{"text":"The requested URL was not found on this server.","code":404}

It's the example almost literarily copied from REST API docs. And I'm getting 404.

Where to look for diagnostic info?

Re: receivers/simple 404

VatsalJagani — Sun, 03 Apr 2022 15:43:57 GMT

@PickleRick - Two points sir, not sure if you have noticed in the document.

It says that the user role requires "edit_tcp" capability.
The example shows management port 8089.

Re: receivers/simple 404

PickleRick — Sun, 03 Apr 2022 18:02:00 GMT

As I wrote, I'm using Free License at home so I have no authentication and multiple users. In free version there is only one automatically authenticated admin user. Besides, if it was a case of permissions I'd rather expect a 403 or 401 than 404.

And the port of course is the same as the configuration. It's the common practice to set up the HTTP endpoint on 8089 when TLS is enabled. In my case I don't need TLS (quite the contrary - lack of TLS enables easier debugging) so I didn't change the default 8089 port.

Re: receivers/simple 404

VatsalJagani — Sun, 03 Apr 2022 18:06:28 GMT

You mentioned you didn't change the default management port 8089 but in your original post you are making request on 8088.
That confused me.

Re: receivers/simple 404

PickleRick — Sun, 03 Apr 2022 18:38:43 GMT

Right! I'm so used to sending over the HEC port, I didn't notice it was supposed to be sent to mgmt port!

Thanks.