topic Re: Cannot connect to HEC on cloud in Getting Data In

Cannot connect to HEC on cloud

pjasiak — Mon, 20 Nov 2023 09:52:37 GMT

Hi, I'm running the curl command:

curl -vvvvv https://prd-p-xxxxx.splunkcloud.com:8088/services/collector/event -H "Authorization: Splunk <token>" -d '{"sourcetype": "my_sample_data", "event": "ping"}'

and I got:
* Trying <IP>:8088...
* connect to <IP> port 8088 failed: Operation timed out
* Failed to connect to prd-p-xxxxx.splunkcloud.com port 8088 after 17497 ms: Couldn't connect to server
* Closing connection 0
curl: (28) Failed to connect to prd-p-xxxxx.splunkcloud.com port 8088 after 17497 ms: Couldn't connect to server

I have free trial, HEC is enabled and token is valid
what could cause this problem?

Re: Cannot connect to HEC on cloud

richgalloway — Mon, 20 Nov 2023 14:10:35 GMT

Check your firewalls to confirm they allow connections to Splunk Cloud port 8088.

Re: Cannot connect to HEC on cloud

PickleRick — Mon, 20 Nov 2023 14:23:08 GMT

Also remember that trial Cloud installation does not fully support HEC over TLS. I don't remember the details though - either you get only unencrypted connection or get the TLS-enabled port but only with some self-signed cert on the server's side.