topic Re: Prisma Cloud Integration in Getting Data In

Prisma Cloud Integration

XOR — Tue, 08 Jul 2025 11:51:12 GMT

Guys i have Splunk Cloud , i created Http Event Collector & in prisma i gave url /service/collector

but logs are not showing up in splunk .. my questions : should i add port number after my http url ?

after url is it /service/collector or /service/collector/events

what should i check as i tesed my prisma said tested pass

Re: Prisma Cloud Integration

livehybrid — Tue, 08 Jul 2025 14:10:13 GMT

Hi @XOR

You shouldnt need to add the port in the Prisma config as Splunk Cloud uses the default HTTPS port for HEC receiving. I assume the URL you used starts https:// ?

As far as I know there is no option to add an index into the Prisma configuration therefore the data will go into the default index you selected when you created the HEC token - Are you able to confirm that this is the index that you are checking in?

Regarding the service/collector or /service/collector/events, you should be able to use the first, or "/services/collector/event" - note no "S" on the end. Prisma Cloud sends HEC events so this is the correct endpoint to use.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Prisma Cloud Integration

XOR — Wed, 09 Jul 2025 03:11:35 GMT

One more question should I go to hec and copy paste that link right ... Can you pls give me example how that hec link should be like.

Eg my link look lke this https://splunkcloudname.com/httpcollector

Re: Prisma Cloud Integration

XOR — Wed, 09 Jul 2025 11:56:12 GMT

I tried this curl command and got this output

curl -k https://<splunkcloudlink>:8088/services/collector/event -H "Authorization: Splunk <hec token>" -d "{\"event\": \"hello from the other side\"}"

Output:
{"text":"Success","code":0}

what should i see next