How to link Aruba Central (logs, reporting etcc) to Splunk server?

[anandnagarajan]

Has anyone linked Aruba Central(logs, reporting etcc) to splunk server?
i was told Webhook was one option.

[alphiapj]

I've been trying to get this to work as well.

Not sure if you had any luck.

I have created a HEC instance and tested it.

I created a webhook, but unsure of the URL to correctly add.  I simply get HTTP 500 status when I test the aruba webhook.

I'm sure there is a better way to setup the URL on the aruba side so it correctly sends data to inject.

[manuel]

Did you finally integrate Aruba Central via HEC?

[alphiapj]

I did get it to work. Much trial and effort as it was my first experience at HEC and webhooks.

This was the correct URL I figured for the Aruba central to send to my HEC.

https://<HEC URL>:8088/services/collector/raw?token=<your token>

[chadmedeiros]

yeah... just be aware that the token will show up in any tool that logs web traffic, since it is just plaintext in the url