<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Error while sending data via SplunkHECExporter in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Error-while-sending-data-via-SplunkHECExporter/m-p/669638#M112276</link>
    <description>&lt;P&gt;I using the OpenTelemetry Collector to receive and export logs to my Splunk Cloud Instance.&lt;BR /&gt;I have a AWS lambda which polls data and runs a OpenTelemetry Lambda layer which receives the logs in the OTLP format and exports it to Splunk cloud Instance using HEC exporter. Below is the configurations for otel&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="ruby"&gt;receivers:
otlp:
protocols:
http:
exporters:
splunk_hec:
token: ${SPLUNK_TOKEN}
endpoint: ${HEC_ENDPOINT}
# Source. See https://docs.splunk.com/Splexicon:Source
source: "otel"
# Source type. See https://docs.splunk.com/Splexicon:Sourcetype
sourcetype: "otel"
service:
pipelines:
logs:
receivers: [otlp]
exporters: [splunk_hec]&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;Now, the problem is the splunk_hec exporter fails to send the logs to my splunk cloud Instance.&lt;BR /&gt;I get the below errors&lt;/P&gt;&lt;LI-CODE lang="javascript"&gt;max elapsed time expired Post "https://inputs.prd-p-gxyqz.splunkcloud.com:8088/services/collector/event": EOF


max elapsed time expired Post "https://inputs.prd-p-gxyqz.splunkcloud.com:8088/services/collector/event": context deadline exceeded&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;Now can you please help me identify the issue.&lt;BR /&gt;Also, what exactly should be my HEC Endpoint URL? The documentation says the format should be&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;protocol&amp;gt;://http-inputs-&amp;lt;host&amp;gt;.splunkcloud.com:&amp;lt;port&amp;gt;/&amp;lt;endpoint&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;But the above format doesn't work.&lt;/P&gt;</description>
    <pubDate>Fri, 24 Nov 2023 12:36:29 GMT</pubDate>
    <dc:creator>Av2</dc:creator>
    <dc:date>2023-11-24T12:36:29Z</dc:date>
    <item>
      <title>Error while sending data via SplunkHECExporter</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Error-while-sending-data-via-SplunkHECExporter/m-p/669638#M112276</link>
      <description>&lt;P&gt;I using the OpenTelemetry Collector to receive and export logs to my Splunk Cloud Instance.&lt;BR /&gt;I have a AWS lambda which polls data and runs a OpenTelemetry Lambda layer which receives the logs in the OTLP format and exports it to Splunk cloud Instance using HEC exporter. Below is the configurations for otel&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="ruby"&gt;receivers:
otlp:
protocols:
http:
exporters:
splunk_hec:
token: ${SPLUNK_TOKEN}
endpoint: ${HEC_ENDPOINT}
# Source. See https://docs.splunk.com/Splexicon:Source
source: "otel"
# Source type. See https://docs.splunk.com/Splexicon:Sourcetype
sourcetype: "otel"
service:
pipelines:
logs:
receivers: [otlp]
exporters: [splunk_hec]&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;Now, the problem is the splunk_hec exporter fails to send the logs to my splunk cloud Instance.&lt;BR /&gt;I get the below errors&lt;/P&gt;&lt;LI-CODE lang="javascript"&gt;max elapsed time expired Post "https://inputs.prd-p-gxyqz.splunkcloud.com:8088/services/collector/event": EOF


max elapsed time expired Post "https://inputs.prd-p-gxyqz.splunkcloud.com:8088/services/collector/event": context deadline exceeded&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;Now can you please help me identify the issue.&lt;BR /&gt;Also, what exactly should be my HEC Endpoint URL? The documentation says the format should be&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;protocol&amp;gt;://http-inputs-&amp;lt;host&amp;gt;.splunkcloud.com:&amp;lt;port&amp;gt;/&amp;lt;endpoint&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;But the above format doesn't work.&lt;/P&gt;</description>
      <pubDate>Fri, 24 Nov 2023 12:36:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Error-while-sending-data-via-SplunkHECExporter/m-p/669638#M112276</guid>
      <dc:creator>Av2</dc:creator>
      <dc:date>2023-11-24T12:36:29Z</dc:date>
    </item>
  </channel>
</rss>

