Getting Data In

Blue Prism Data Gateway integration with Splunk

blueprism-akin
Observer

Hi,

I am new to Splunk, and I am doing some testing with Blue Prism Data gateway with Splunk. How can I get the Splunk URL and API Token

Labels (1)
0 Karma

_JP
Contributor

Based on your description it sounds like you are configuring the Blue Prism side of things to point at the HTTP Event Collector (HEC).  To get the URL and token, you'll need to make sure the HEC configuration has been completed on the Splunk side so Blue Prism has a place to send its data.

Here's the documentation that pertains to configuration of the HEC component in Splunk:

https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector 

0 Karma

blueprism-akin
Observer

Hi JP,

Thank you for getting back to my message. I have gone through the documentation to enable HEC and generate the token. I also enabled SSL. This is part i am getting confused

<protocol>://<host>:<port>/<endpoint>

in the documentation. 

And i have it set as this - https://computer-name:8088/services/collector/event

Is that correct?

0 Karma

_JP
Contributor

Assuming that you configured your HEC port to be 8088, that URL looks correct to me.  Also, that endpoint expects JSON data - is that what Blue Prism is sending?

There are several REST endpoints you can post to for the Splunk HEC documented here.

Also, here is a page with some curl commands you can use to test out the HEC endpoint locally to rule out where the issue is - that is, if it works with curl, then is there a network issue in between (e.g. firewall).

HTTP Event Collector examples - Splunk Documentation

 

 

 

https://mysplunkserver.example.com:8088/services/collector

 

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...