What is the URI for HTTP Event Collector for Splunk Cloud?

[saasuser]

I am trying out Splunk Cloud and I want to set up an HTTP Event Collector. The instructions here to set up the HEC URI didn't quite work for me .

If my instance URL is https://xyz.cloud.splunk.com what is the equivalent HEC URI? I have tried variations as http://input-xyz.cloud.splunk.com:8088/services/collector, http://http-inputs-xyz.cloud.splunk.com:8088/services/collector as well as the SSL ones, but none worked.

Any help is appreciated.

[new_splunker]

curl -kv https://<host>.<stack>.splunkcloud.com:8088/services/collector/health
Where <host>.<stack>, you will find if you run `index=_internal` and see `host` field.

[bay62]

when i use curl to ingest data into splunk using command below, it works fine :

curl -k https://input-prd-id.cloud.splunk.com:8088/services/collector -H 'Authorization: Splunk token-id' -d '{"event":"hello world", "sourcetype": "manual"}'

but i want to disable ssl encryption while creating HEC token
how can i do that ?

,

[amiracle]

While you can disable ssl for HEC, keep in mind that it will impact your Splunk web ssl configuration. Per the docs : "Whether the HTTP Event Collector server protocol is HTTP or HTTPS. 0 indicates HTTPS is enabled; 1 indicates HTTP. The default value is 0. HTTP Event Collector shares SSL settings with the Splunk management server and cannot have enableSSL settings that differ from the settings on the Splunk management server." http://dev.splunk.com/view/event-collector/SP-CAAAE6Q

[amiracle]

For Splunk Cloud customers, the standard HEC URI is:
https://http-inputs-customer_stack.splunkcloud.com/services/collector

If you are using AWS Firehose, then you will have a second HEC URL:
https://http-inputs-firehose-customer_stack.splunkcloud.com/services/collector

Please note that Splunk Cloud customers do NOT need to specify port 8088, all HEC traffic goes over port 443 (standard SSL).

For customers running HEC on their own deployments or using the Splunk test drive instance, then port 8088 will need to be specified:
https://input-prd-uniqueid.cloud.splunk.com:8088/services/collector

In either situation, you can use the following command to validate the URL is valid:
Splunk Cloud:

%>nslookup http-inputs-<customer_stack>.splunkcloud.com

Splunk Test Drive:

$ nslookup input-prd-uniqueid.cloud.splunk.com

It will respond with the instances behind the load balancer.

[NZenitram]

Have these instructions changed since this was posted?

The Splunk Cloud URL doesn't resolve for me. I am on the free version of Splunk Cloud with an Enabled HEC.

[maraman_splunk]

In general, it is better to use  entires  with  xxxxxx.mystack.splunkcloud.com where mystack is your stackid

HEC :  https://http-inputs.mystack.splunkcloud.com/

[new_splunker]

Likely HEC not available for 14 days demo version of Splunk Cloud Platform.

[new_splunker]

Finally found the working URI for demo version of Splunk Cloud Platform.

curl -kv https://<host>.<stack>.splunkcloud.com:8088/services/collector/health
Where <host>.<stack>, you will find if you run `index=_internal` and see `host` field.

[nramella]

Thanks, this explained everything I needed for how to use HEC on Splunkcloud.

[jonh1]

I created a cloud trial instance today and I tried those URLs for HEC and they are not working for me.  Is it something else now?

[h4llm3n]

You should use https://inputs.prd-yourid.splunkcloud.com:8088/services/collector for your trial instance.

[Reva159]

what is prd-yourid means?

[h4llm3n]

Thats simply the ID you get from Splunk. Go to your cloud instance URL and you'll see it.

[Reva159]

Thank you

[saasuser]

Link for HTTP Event Collector is https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#HEC_and_managed_Sp...