Splunk Cloud Trial HEC Not Working

[Klaverblad]

Hi all,

I just started a trial for Splunk Cloud , my URL looks similar to this:

https://prd-p-s8qvw.splunkcloud.com/en-GB/app/launcher/home

I want to get data in with the HEC. I have read all the following documentation:

https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Data/UsetheHTTPEventCollector#Configure_H...

According to the documentation, my URL should look like this:

https://http-inputs-prd-p-s8qvw.splunkcloud.com:8088/services/collector/event

However this does not work. It seems the DNS cannot be resolved. My NodeJS gives "ENOTFOUND"

I have tried different options (HHTP / HTTPS, host, port etc):

• HTTP: http://http-inputs-prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• HTTPS: https://http-inputs-prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• GCP: http://http-inputs.prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• https://http-inputs.prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• host: http://http-inputs-prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• http://http-inputs-p-s8qvw.splunkcloud.com:8088/services/collector/event
• http://http-inputs-s8qvw.splunkcloud.com:8088/services/collector/event
• http://http-inputs.s8qvw.splunkcloud.com:8088/services/collector/event
• https://http-inputs-prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• https://http-inputs-p-s8qvw.splunkcloud.com:8088/services/collector/event
• https://http-inputs-s8qvw.splunkcloud.com:8088/services/collector/event
• https://http-inputs.s8qvw.splunkcloud.com:8088/services/collector/event
• port: http://http-inputs-prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• https://http-inputs-prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• http://http-inputs.prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• https://http-inputs.prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• http://http-inputs-prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• http://http-inputs-p-s8qvw.splunkcloud.com:443/services/collector/event
• http://http-inputs-s8qvw.splunkcloud.com:443/services/collector/event
• http://http-inputs.s8qvw.splunkcloud.com:443/services/collector/event
• https://http-inputs-prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• https://http-inputs-p-s8qvw.splunkcloud.com:443/services/collector/event
• https://http-inputs-s8qvw.splunkcloud.com:443/services/collector/event
• https://http-inputs.s8qvw.splunkcloud.com:443/services/collector/event
• No prefix: http://prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• https://prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• http://prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• https://prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• http://prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• http://p-s8qvw.splunkcloud.com:8088/services/collector/event
• http://s8qvw.splunkcloud.com:8088/services/collector/event
• http://s8qvw.splunkcloud.com:8088/services/collector/event
• https://prd-p-s8qvw.splunkcloud.com:8088/services/collector/event
• https://p-s8qvw.splunkcloud.com:8088/services/collector/event
• https://s8qvw.splunkcloud.com:8088/services/collector/event
• https://s8qvw.splunkcloud.com:8088/services/collector/event
• http://prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• https://prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• http://prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• https://prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• http://prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• http://p-s8qvw.splunkcloud.com:443/services/collector/event
• http://s8qvw.splunkcloud.com:443/services/collector/event
• http://s8qvw.splunkcloud.com:443/services/collector/event
• https://prd-p-s8qvw.splunkcloud.com:443/services/collector/event
• https://p-s8qvw.splunkcloud.com:443/services/collector/event
• https://hs8qvw.splunkcloud.com:443/services/collector/event
• https://s8qvw.splunkcloud.com:443/services/collector/event

None of these work. All give one of the following errors:

• Error: getaddrinfo ENOTFOUND http-inputs-prd-p-s8qvw.splunkcloud.com
• Error: read ECONNRESET
• HTTP 400 Sent HTTP to port 443
• HTTP 404 Not Found

Can anybody help me get this working?

Regards,

Lawrence

[Klaverblad · Accepted solution]

It seems the company firewall blocked outbound traffic to 8088. Issue explained

[Klaverblad]

Note:

• I have an active token that looks similar to this: c0865140-53b4-4b53-a2d1-9571d39a5de8
• My HTTP request has the following header:
  Authorization: Splunk c0865140-53b4-4b53-a2d1-9571d39a5de8
• MY Splunk Cloud settings show HEC configuration to have SSL enabled and port 8088 (though these settings are grayed out and cannot be adjusted)