Testing something on my Splunk Free at home using receivers/simple endpoint and all I'm getting is 404

[PickleRick]

I'm kinda lost here.

I'm trying to test something on my Splunk Free at home using receivers/simple endpoint and all I'm getting is 404.

The "normal" HEC endpoints work OK.

$ curl "http://172.16.0.3:8088/services/receivers/simple?source=www&sourcetype=web_event" -d "aaaaaaaaaaaaaa"
{"text":"The requested URL was not found on this server.","code":404}

It's the example almost literarily copied from REST API docs. And I'm getting 404.

Where to look for diagnostic info?

[VatsalJagani]

@PickleRick  - Two points sir, not sure if you have noticed in the document.

1. It says that the user role requires "edit_tcp" capability.
2. The example shows management port 8089.
   1. 
   2. 

[PickleRick]

As I wrote, I'm using Free License at home so I have no authentication and multiple users. In free version there is only one automatically authenticated admin user. Besides, if it was a case of permissions I'd rather expect a 403 or 401 than 404.

And the port of course is the same as the configuration. It's the common practice to set up the HTTP endpoint on 8089 when TLS is enabled. In my case I don't need TLS (quite the contrary - lack of TLS enables easier debugging) so I didn't change the default 8089 port.

[VatsalJagani · Accepted solution]

You mentioned you didn't change the default management port 8089 but in your original post you are making request on 8088.
That confused me.

[PickleRick]

Right! I'm so used to sending over the HEC port, I didn't notice it was supposed to be sent to mgmt port!

Thanks.