403 Error on some requesets

[sigma]

Hello all,

I send some logs from multiple endpoints to a standalone Splunk HTTP Event Collector. Many logs are sent successfully but some of them (same index, same endpoint, ...) . But some of them get 403 when sending and are not sent. I think maybe it's for threads or sockets.

Any ideas are appreciated 🙂

[richgalloway · Accepted solution]

HEC error 403 is a token problem.  Check that the sender is configured properly.

https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector#Possible_err...