Splunk Cloud Trial HEC Not Working

Klaverblad — Thu, 16 Jan 2025 10:40:38 GMT

Hi all,

I just started a trial for Splunk Cloud , my URL looks similar to this:

I want to get data in with the HEC. I have read all the following documentation:

According to the documentation, my URL should look like this:

However this does not work. It seems the DNS cannot be resolved. My NodeJS gives "ENOTFOUND"

I have tried different options (HHTP / HTTPS, host, port etc):

None of these work. All give one of the following errors:

Can anybody help me get this working?

Regards,

Lawrence

Re: Splunk Cloud Trial HEC Not Working

Klaverblad — Thu, 16 Jan 2025 10:44:28 GMT

Note:

I have an active token that looks similar to this: c0865140-53b4-4b53-a2d1-9571d39a5de8
My HTTP request has the following header:
Authorization: Splunk c0865140-53b4-4b53-a2d1-9571d39a5de8
MY Splunk Cloud settings show HEC configuration to have SSL enabled and port 8088 (though these settings are grayed out and cannot be adjusted)

Klaverblad — Thu, 16 Jan 2025 15:34:06 GMT

It seems the company firewall blocked outbound traffic to 8088. Issue explained