topic Re: HEC to aws(dynamodb) in Getting Data In

HEC to aws(dynamodb)

rsilwal7 — Fri, 28 Aug 2020 01:47:15 GMT

Hello, I am using HEC to send data from aws(dynamodb) to splunk. I am getting error called"ECONNREFUSED","errno":"ECONNREFUSED at TCPConnectWrap.afterConnect [as oncomplete] ",

Can anyone tell me a better method to do the task or some advice to solve this issue??

Re: HEC to aws(dynamodb)

richgalloway — Fri, 28 Aug 2020 12:59:18 GMT

Either Splunk is not listening on the designated port or you're using the wrong address/port or a firewall is in the way.

Re: HEC to aws(dynamodb)

isoutamo — Fri, 28 Aug 2020 15:09:50 GMT

one way to test it (unless it is called from lambda or other serverless services) with curl

curl -v -k "https://localhost:8088/services/collector/event" -H "Authorization: Splunk 9dd3e284-1619-4070-be37-59250cd52876" -d '{"event": "Hello, world!", "sourcetype": "manual"}'

with -v You will get also debug information.

r. Ismo

Re: HEC to aws(dynamodb)

rsilwal7 — Sat, 29 Aug 2020 04:46:07 GMT

Hello,

I have set the port to 8088 and issued the token. Do I have to do additional settings ??

Re: HEC to aws(dynamodb)

rsilwal7 — Sat, 29 Aug 2020 04:47:59 GMT

Hi!

I am doing the test from lambda. So, is there any other way from which I would fond out the exact error??

Re: HEC to aws(dynamodb)

isoutamo — Sat, 29 Aug 2020 08:09:37 GMT

Then probably the easiest case is set up another node to the same net where those lambdas are run and test there. Quite often the reason is that your HEC servers’ SG is missing that network.
r. Ismo

Re: HEC to aws(dynamodb)

rsilwal7 — Sun, 30 Aug 2020 12:16:31 GMT

Do you mean assigning other port? I tried using 8080 port as well but the result was the same.

Re: HEC to aws(dynamodb)

isoutamo — Sun, 30 Aug 2020 14:20:19 GMT

No, I mean that you must check what is your security groups for that HEC-node in AWS node level. In those you must add that port 8088 to allow traffic wherever you want. Without that those event never comes to node, those are just dropped by AWS security group definition. You could check these by AWS Console.

r. Ismo

Re: HEC to aws(dynamodb)

rsilwal7 — Tue, 01 Sep 2020 06:26:28 GMT

Hello,

thank you for your reply, I am actually little new to these, so, can you describe how it can be done?

Re: HEC to aws(dynamodb)

rsilwal7 — Tue, 01 Sep 2020 06:36:15 GMT

Hi!

I have checked in aws and I see these in inbound rules. do I have to change anything. for outbound rule it is assigned as access to all.node

Re: HEC to aws(dynamodb)

isoutamo — Tue, 01 Sep 2020 07:20:36 GMT

I don't see inbound rule for port 8088. This means that AWS SG blocks all request to that port and those are not seen at OS level nor splunkd.
r. Ismo

Re: HEC to aws(dynamodb)

rsilwal7 — Tue, 01 Sep 2020 08:07:06 GMT

so that means I have to add new inbound port??

Re: HEC to aws(dynamodb)

isoutamo — Tue, 01 Sep 2020 08:14:36 GMT

Unfortunately I don't know what is policy / processes in your environment. Options are use cloud formation template or directly in AWS console. You must figure out in your environment/organization how this must do.
r. Ismo

Re: HEC to aws(dynamodb)

maraman_splunk — Tue, 01 Sep 2020 08:23:24 GMT

You will have at least to :

- make sure your lambda function run in your vpc (so the network connection start in your vpc and can reach your hec port) (see https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html ) (unless your hec can be accessed from outside your vpc)

- allow port TCP 8088 inbound in the security group (where you receive HEC) (connection refused -> probably your main issue as already pointed above)

- you may have also to play with certificate checking options in your lambda function (especially if you dont use a valid certificate for hec)

Re: HEC to aws(dynamodb)

rsilwal7 — Wed, 02 Sep 2020 01:03:35 GMT

I installed the Splunk on aws from AMI. so it has elastic IP and can be accessed from other network as well.

I tried adding another port with 8088 in security group but the output is the same.