Getting Data In
Highlighted

What is the URI for HTTP Event Collector for Splunk Cloud?

Engager

I am trying out Splunk Cloud and I want to set up an HTTP Event Collector. The instructions here to set up the HEC URI didn't quite work for me .

If my instance URL is https://xyz.cloud.splunk.com what is the equivalent HEC URI? I have tried variations as http://input-xyz.cloud.splunk.com:8088/services/collector, http://http-inputs-xyz.cloud.splunk.com:8088/services/collector as well as the SSL ones, but none worked.

Any help is appreciated.

0 Karma
Highlighted

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

Engager
Highlighted

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

Splunk Employee
Splunk Employee

For Splunk Cloud customers, the standard HEC URI is:
https://http-inputs-customer_stack.splunkcloud.com/services/collector

If you are using AWS Firehose, then you will have a second HEC URL:
https://http-inputs-firehose-customer_stack.splunkcloud.com/services/collector

Please note that Splunk Cloud customers do NOT need to specify port 8088, all HEC traffic goes over port 443 (standard SSL).

For customers running HEC on their own deployments or using the Splunk test drive instance, then port 8088 will need to be specified:
https://input-prd-uniqueid.cloud.splunk.com:8088/services/collector

In either situation, you can use the following command to validate the URL is valid:
Splunk Cloud:

%>nslookup http-inputs-<customer_stack>.splunkcloud.com

Splunk Test Drive:

$ nslookup input-prd-uniqueid.cloud.splunk.com

It will respond with the instances behind the load balancer.

0 Karma
Highlighted

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

New Member

when i use curl to ingest data into splunk using command below, it works fine :

curl -k https://input-prd-id.cloud.splunk.com:8088/services/collector -H 'Authorization: Splunk token-id' -d '{"event":"hello world", "sourcetype": "manual"}'

but i want to disable ssl encryption while creating HEC token
how can i do that ?

,

0 Karma
Highlighted

Re: What is the URI for HTTP Event Collector for Splunk Cloud?

Splunk Employee
Splunk Employee

While you can disable ssl for HEC, keep in mind that it will impact your Splunk web ssl configuration. Per the docs : "Whether the HTTP Event Collector server protocol is HTTP or HTTPS. 0 indicates HTTPS is enabled; 1 indicates HTTP. The default value is 0. HTTP Event Collector shares SSL settings with the Splunk management server and cannot have enableSSL settings that differ from the settings on the Splunk management server." http://dev.splunk.com/view/event-collector/SP-CAAAE6Q

0 Karma