Getting Data In

HEC stopped working

corti77
Communicator

Hi,

I have an issue with our HEC service in our Splunk standalone installation (9.0.6). It simply does not complete the TCP connection for some unknown reason.

Local FW is OFF. Ping works but TCP does not complete the connection.

corti77_0-1695650916542.png

 

everything else works normally. I can connect to Splunk and search data, and universal forwarders report commonly (no deployment errors)... only HEC does not work as it should.

HEC global settings

corti77_1-1695650700127.png

from wireshark, the TCP retransmition can be seen but I can't find the root cause for it.

corti77_0-1695651461233.png

 

any idea of what could be happening?

many thanks.

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...