Getting Data In

Help with firehose ingestion

brent_weaver
Builder

Hello all... I am trying to use the Splunk-Trumpet project to a HEC end point with indexer ack, a valid SSL cert and internet facing. I can use curl to POST data to this endpoint with SSL enabled, so this tells me that at the most basic levels my HEC and it's associated infra is setup right.

Since this sets up an S3 bucket for backup should the firehose fail, i am able to browse that and I see the following message:

<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>E1B619A2DC6BDD3F</RequestId>
<HostId>
pBxYzfWxtG+IfA77uG2ozJ3RNaEf8h4lv83lRDCJ7hmBYU4cPRMSRKk8CxNP761OjONm21jZNLM=
</HostId>
</Error>

Any help is MUCH appreciated, this is a HUGE improvement over the previous ingestion methods.

0 Karma

badrinath_itrs
Communicator

This appears to be some sort of problem with AWS Permission.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...