topic Re: Proper URL for using Splunk HTTP Event Collector on free cloud account. in Getting Data In

Proper URL for using Splunk HTTP Event Collector on free cloud account?

JimO — Fri, 05 May 2023 18:19:09 GMT

Hi,

I believe I should be able to use Splunk HTTP Event Collector to send events to Splunk. I have created an Event Collector token, I have tried a bunch of different URLs, none seem to work. I have tried Curl and Postman. For a free account if my URL is https://prd-p-m95xx.splunkcloud.com, what would be my URL?

Here's my curl command
curl "MysteryURL" -H "Authorization: Splunk 11111111-2222-3333-4444-555555555555" -d "{\"event\": \"Hello, Anyone!\", \"sourcetype\": \"manual\"}" -v

Thanks

Re: Proper URL for using Splunk HTTP Event Collector on free cloud account.

richgalloway — Fri, 05 May 2023 18:06:22 GMT

Your URL should be https://http-inputs-prd-p-m95xx.splunkcloud.com:8088

curl -k https://http-inputs-prd-p-m95xx.splunkcloud.com:8088 -H "Authorization: Splunk 11111111-2222-3333-4444-555555555555" -d "{\"event\": \"Hello, Anyone!\", \"sourcetype\": \"manual\"}" -v

Re: Proper URL for using Splunk HTTP Event Collector on free cloud account.

JimO — Fri, 05 May 2023 18:44:40 GMT

Hi,

Thanks for the reply. I had tried that earlier, and I just did again. this is what I got

C:\>curl -k https://http-inputs-prd-p-m95xx.splunkcloud.com:8088 -H "Authorization: Splunk 11111111-2222-3333-4444-555555555555" -d "{\"event\": \"Hello, Jojo!\", \"sourcetype\": \"manual\"}" -v
* Trying 143.244.220.150:8088...
* connect to 143.244.220.150 port 8088 failed: Timed out
* Failed to connect to http-inputs-prd-p-m95xx.splunkcloud.com port 8088 after 21158 ms: Couldn't connect to server
* Closing connection 0
curl: (28) Failed to connect to http-inputs-prd-p-m90yo.splunkcloud.com port 8088 after 21158 ms: Couldn't connect to server

So, I'm not sure what the issue is, but it looks like it is not the URL.

Anyone else have any ideas?

Re: Proper URL for using Splunk HTTP Event Collector on free cloud account.

richgalloway — Fri, 05 May 2023 19:20:20 GMT

Make sure your firewall is allowing connections to that host and port.

Re: Proper URL for using Splunk HTTP Event Collector on free cloud account?

JimO — Mon, 08 May 2023 13:45:26 GMT

Hi Rich,

Thanks again for your help. My Firewall lets all outbound connections through. Has a test I temporarily turned off my firewall, but still had the same issue. I am baffled.

Re: Proper URL for using Splunk HTTP Event Collector on free cloud account.

JimO — Mon, 08 May 2023 18:53:15 GMT

Here is the URL that finally worked

https://prd-p-m90yo.splunkcloud.com:8088/services/collector

Re: Proper URL for using Splunk HTTP Event Collector on free cloud account.

JimO — Mon, 08 May 2023 18:55:16 GMT

Sorry that should be

https://prd-p-m95xx.splunkcloud.com:8088/services/collector

Re: Proper URL for using Splunk HTTP Event Collector on free cloud account.

JimO — Mon, 08 May 2023 19:25:53 GMT

This also works

https://inputs.prd-p-m95xx.splunkcloud.com:8088/services/collector