What is the URI for HTTP Event Collector for Splunk Cloud?

[saasuser]

I am trying out Splunk Cloud and I want to set up an HTTP Event Collector. The instructions here to set up the HEC URI didn't quite work for me .

If my instance URL is https://xyz.cloud.splunk.com what is the equivalent HEC URI? I have tried variations as http://input-xyz.cloud.splunk.com:8088/services/collector, http://http-inputs-xyz.cloud.splunk.com:8088/services/collector as well as the SSL ones, but none worked.

Any help is appreciated.

[bay62]

when i use curl to ingest data into splunk using command below, it works fine :

curl -k https://input-prd-id.cloud.splunk.com:8088/services/collector -H 'Authorization: Splunk token-id' -d '{"event":"hello world", "sourcetype": "manual"}'

but i want to disable ssl encryption while creating HEC token
how can i do that ?

,

[amiracle]

While you can disable ssl for HEC, keep in mind that it will impact your Splunk web ssl configuration. Per the docs : "Whether the HTTP Event Collector server protocol is HTTP or HTTPS. 0 indicates HTTPS is enabled; 1 indicates HTTP. The default value is 0. HTTP Event Collector shares SSL settings with the Splunk management server and cannot have enableSSL settings that differ from the settings on the Splunk management server." http://dev.splunk.com/view/event-collector/SP-CAAAE6Q

[amiracle]

For Splunk Cloud customers, the standard HEC URI is:
https://http-inputs-customer_stack.splunkcloud.com/services/collector

If you are using AWS Firehose, then you will have a second HEC URL:
https://http-inputs-firehose-customer_stack.splunkcloud.com/services/collector

Please note that Splunk Cloud customers do NOT need to specify port 8088, all HEC traffic goes over port 443 (standard SSL).

For customers running HEC on their own deployments or using the Splunk test drive instance, then port 8088 will need to be specified:
https://input-prd-uniqueid.cloud.splunk.com:8088/services/collector

In either situation, you can use the following command to validate the URL is valid:
Splunk Cloud:

%>nslookup http-inputs-<customer_stack>.splunkcloud.com

Splunk Test Drive:

$ nslookup input-prd-uniqueid.cloud.splunk.com

It will respond with the instances behind the load balancer.

[nramella]

Thanks, this explained everything I needed for how to use HEC on Splunkcloud.

[jonh1]

I created a cloud trial instance today and I tried those URLs for HEC and they are not working for me.  Is it something else now?

[h4llm3n]

You should use https://inputs.prd-yourid.splunkcloud.com:8088/services/collector for your trial instance.

[Reva159]

what is prd-yourid means?

[h4llm3n]

Thats simply the ID you get from Splunk. Go to your cloud instance URL and you'll see it.

[Reva159]

Thank you

[saasuser]

Link for HTTP Event Collector is https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#HEC_and_managed_Sp...