This sounds like a network issue - the connection from your sharepoint server to the Splunk Cloud will be going through various network elements e.g. proxies, firewalls, etc. which may be changing the address being used e.g. PAT and NAT such that the server the request ends up at either isn't the server you think it is or it is using a different port, hence the connection refused. Could this be the issue?
