Getting Data In

How to check if an HEC is up or not before posting any data to it?

sathwikakamai
Engager

Hi, I am trying to post data to Splunk using HEC. But before posting I want to check if the endpoint I'm trying to post data to is up or not. How can I check that.

e.g: There is on HEC - Named Test with auth token "d51d25fc-6fa2-4841-b430-be55876332b7". I post data using curl request -
curl -k http://localhost:8088/services/collector -H 'Authorization: Splunk d51d25fc-6fa2-4841-b430-be55876332b7' -d '{"sourcetype": "input", "event":"Hello, World!"}'

How can we check if that particular endpoint is up and accepting data input.

Please note that this is our customer Splunk endpoint, hence we have only the HEC URL and AuthToken. And we don't want to post any dummy data just to check if the post is successful or not.

Tags (1)
1 Solution

spavin
Path Finder

Hi @sathwikakamai,

If you are confident that the HEC endpoint is set up correctly, there are no firewall restrictions between you and it, and the authorization token is correct, you should be able to run the following curl command:

curl -k https://localhost:8088/services/collector -H 'Authorization: Splunk d51d25fc-6fa2-4841-b430-be55876332b7' -d ''

It will return something like:
{"text":"No data","code":5}

It will not submit any data to the index, but it will check that:

  • There are no firewall issues between where you ran the command and the HEC endpoint
  • The authentication token is correct, and working

You can add an additional check by supplying an index that you expect to be valid, while still not sending an event:

curl -k https://localhost:8088/services/collector -H 'Authorization: Splunk d51d25fc-6fa2-4841-b430-be55876332b7' -d '{"index":"my_index"}'

The response will either tell you that the index is incorrect (meaning the HEC endpoint doesn't allow adding events to that index), or that there was no event supplied - indicating that the index is allowed.

View solution in original post

PvandenHondel
Explorer

With these tests, I can check if the Splunk side of the HEC is correctly configured. Thanks @spavin!!

Tags (3)
0 Karma

Jeremiah
Motivator

You can also check the health endpoint.

curl -k https://localhost:8088/services/collector/health

You should get a response similar to:

{"text":"HEC is healthy","code":17}

Note that this doesn't validate your token.

spavin
Path Finder

Hi @sathwikakamai,

If you are confident that the HEC endpoint is set up correctly, there are no firewall restrictions between you and it, and the authorization token is correct, you should be able to run the following curl command:

curl -k https://localhost:8088/services/collector -H 'Authorization: Splunk d51d25fc-6fa2-4841-b430-be55876332b7' -d ''

It will return something like:
{"text":"No data","code":5}

It will not submit any data to the index, but it will check that:

  • There are no firewall issues between where you ran the command and the HEC endpoint
  • The authentication token is correct, and working

You can add an additional check by supplying an index that you expect to be valid, while still not sending an event:

curl -k https://localhost:8088/services/collector -H 'Authorization: Splunk d51d25fc-6fa2-4841-b430-be55876332b7' -d '{"index":"my_index"}'

The response will either tell you that the index is incorrect (meaning the HEC endpoint doesn't allow adding events to that index), or that there was no event supplied - indicating that the index is allowed.

orangered6000
Engager

Is this better than calling the /health endpoint? Or was this answer written before that existed?

IE: https://localhost:8088/services/collector/health

sathwikakamai
Engager

Thanks @spavin , it was very helpful.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...