HttpListener - Socket error from 10.23.132.224:49352: Connection closed by peer

[rashi83]

Hi, I am getting this error and after that HEC stops sending the events to Splunk. Also, seeing these errors -

ttpListener - Read Timeout communicating with 10.23.132.224:50926, disconnecting

Any idea why events stops coming to SPlunk?

[vsai0718]

Is there any firewall blocking the communication between the server and HEC's server. Try telnet from the server you're looking to send the logs to the HEC. If it is good, debug it by using curl for HEC

curl -k http://IP_of_HEC_host:8088/services/collector -H 'Authorization: Splunk token' -d '{"sourcetype": "sourcetype_of_HEC_configured", "event":"Hello, World!"}'