topic Re: What is the URI for HTTP Event Collector for Splunk Cloud? in Getting Data In

What is the URI for HTTP Event Collector for Splunk Cloud?

saasuser — Thu, 06 Dec 2018 23:34:36 GMT

I am trying out Splunk Cloud and I want to set up an HTTP Event Collector. The instructions here to set up the HEC URI didn't quite work for me .

If my instance URL is https://xyz.cloud.splunk.com what is the equivalent HEC URI? I have tried variations as http://input-xyz.cloud.splunk.com:8088/services/collector, http://http-inputs-xyz.cloud.splunk.com:8088/services/collector as well as the SSL ones, but none worked.

Any help is appreciated.

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

saasuser — Thu, 06 Dec 2018 23:35:30 GMT

Link for HTTP Event Collector is https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#HEC_and_managed_Splunk_Cloud

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

amiracle — Fri, 07 Dec 2018 14:55:27 GMT

For Splunk Cloud customers, the standard HEC URI is:
https://http-inputs-customer_stack.splunkcloud.com/services/collector

If you are using AWS Firehose, then you will have a second HEC URL:
https://http-inputs-firehose-customer_stack.splunkcloud.com/services/collector

Please note that Splunk Cloud customers do NOT need to specify port 8088, all HEC traffic goes over port 443 (standard SSL).

For customers running HEC on their own deployments or using the Splunk test drive instance, then port 8088 will need to be specified:
https://input-prd-uniqueid.cloud.splunk.com:8088/services/collector

In either situation, you can use the following command to validate the URL is valid:
Splunk Cloud:

%>nslookup http-inputs-<customer_stack>.splunkcloud.com

Splunk Test Drive:

$ nslookup input-prd-uniqueid.cloud.splunk.com

It will respond with the instances behind the load balancer.

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

bay62 — Wed, 16 Oct 2019 06:54:25 GMT

when i use curl to ingest data into splunk using command below, it works fine :

curl -k https://input-prd-id.cloud.splunk.com:8088/services/collector -H 'Authorization: Splunk token-id' -d '{"event":"hello world", "sourcetype": "manual"}'

but i want to disable ssl encryption while creating HEC token
how can i do that ?

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

amiracle — Wed, 16 Oct 2019 17:13:48 GMT

While you can disable ssl for HEC, keep in mind that it will impact your Splunk web ssl configuration. Per the docs : "Whether the HTTP Event Collector server protocol is HTTP or HTTPS. 0 indicates HTTPS is enabled; 1 indicates HTTP. The default value is 0. HTTP Event Collector shares SSL settings with the Splunk management server and cannot have enableSSL settings that differ from the settings on the Splunk management server." http://dev.splunk.com/view/event-collector/SP-CAAAE6Q

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

jonh1 — Wed, 12 Aug 2020 18:59:23 GMT

I created a cloud trial instance today and I tried those URLs for HEC and they are not working for me. Is it something else now?

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

h4llm3n — Wed, 10 Mar 2021 10:40:21 GMT

You should use https://inputs.prd-yourid.splunkcloud.com:8088/services/collector for your trial instance.

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

Reva159 — Wed, 22 Sep 2021 18:42:41 GMT

what is prd-yourid means?

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

h4llm3n — Thu, 23 Sep 2021 06:48:01 GMT

Thats simply the ID you get from Splunk. Go to your cloud instance URL and you'll see it.

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

Reva159 — Thu, 23 Sep 2021 07:32:47 GMT

Thank you

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

nramella — Thu, 07 Dec 2023 22:10:35 GMT

Thanks, this explained everything I needed for how to use HEC on Splunkcloud.

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

maraman_splunk — Tue, 17 Sep 2024 11:13:37 GMT

In general, it is better to use entires with xxxxxx.mystack.splunkcloud.com where mystack is your stackid

HEC : https://http-inputs.mystack.splunkcloud.com/

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

NZenitram — Mon, 23 Dec 2024 22:05:08 GMT

Have these instructions changed since this was posted?

The Splunk Cloud URL doesn't resolve for me. I am on the free version of Splunk Cloud with an Enabled HEC.

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

new_splunker — Sun, 02 Feb 2025 20:43:58 GMT

Likely HEC not available for 14 days demo version of Splunk Cloud Platform.

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

new_splunker — Sun, 02 Feb 2025 20:59:10 GMT

Finally found the working URI for demo version of Splunk Cloud Platform.

curl -kv https://<host>.<stack>.splunkcloud.com:8088/services/collector/health
Where <host>.<stack>, you will find if you run `index=_internal` and see `host` field.

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

new_splunker — Sun, 02 Feb 2025 21:00:05 GMT

curl -kv https://<host>.<stack>.splunkcloud.com:8088/services/collector/health
Where <host>.<stack>, you will find if you run `index=_internal` and see `host` field.

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

s_palan — Wed, 04 Jun 2025 18:02:04 GMT

The HOST field worked! Thanks @new_splunker . I'm trying to ingest a webhook into the Splunk cloud trial instance.
I'm getting a SSL certification error - failed to verify the legitimacy of the server and therefore could not establish a secure connection to it
were there any other setting you did to establish the webhook connection?