Hi, I am getting this error and after that HEC stops sending the events to Splunk. Also, seeing these errors -
ttpListener - Read Timeout communicating with 10.23.132.224:50926, disconnecting
Any idea why events stops coming to SPlunk?
Is there any firewall blocking the communication between the server and HEC's server. Try telnet from the server you're looking to send the logs to the HEC. If it is good, debug it by using curl for HEC
curl -k http://IP_of_HEC_host:8088/services/collector -H 'Authorization: Splunk token' -d '{"sourcetype": "sourcetype_of_HEC_configured", "event":"Hello, World!"}'
