Getting Data In

Why are AWX and HEC not working?

New Member


Newish to splunk here.

We have an AWX instance (free Tower) and we are trying to send the logs to splunk using this link:


All is good there.  I can do a tcpdump and see data going out to port 8088 on my splunk management server.

I used this link to set up HEC on Splunk Enterprise 9.0.2:


I can run the curl -k ..... test and get:  RETURNS: {"text":"Success","code":0}

So things seem ok.  When I try a search, I get nothing.  We've using the default index.

Any ideas?



Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...