Getting Data In

Why did curl failed with error code 56?


I am trying to list existing HEC tokens with curl command as below:



curl -k -u admin:<admin_password> http://<splunk_enterprise_instance_ip>:8089/servicesNS/admin/splunk_httpinput/data/inputs/http -v



It retruned as below:



*   Trying
* Connected to ( port 8089 (#0)
* Server auth using Basic with user 'admin'
> GET /servicesNS/admin/splunk_httpinput/data/inputs/http HTTP/1.1
> Host: <splunk_enterprise_instance_ip>:8089
> Authorization: Basic YWRtaW46UGFzc3dvcmQwMTIzIQ==
> User-Agent: curl/7.61.1
> Accept: */*
* Recv failure: Connection reset by peer
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer



From splunkd.log: 



01-09-2023 11:42:33.082 +0800 WARN  HttpListener [3447 HttpDedicatedIoThread-0] - Socket error from <splunk_enterprise_instance_ip>:38846 while idling: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request



It seems this is ownign to SSL.

However, I have disbaled SSL in both Splunk Enterprise Instance and HEC, from inputs.conf:



[dujas@centos8-1 local]$ cat /home/dujas/splunk/etc/apps/splunk_httpinput/local/inputs.conf
disabled = 0
enableSSL = 0



May I l know how I could make the http work?


Labels (1)
Tags (2)
0 Karma


I noticed the splunkdssl is enabled by default in server.conf, after disabling it in config file:


enableSplunkdSSL = False


Afterwards, I issued the same curl command and got output as below:

    <link href="/servicesNS/nobody/splunk_httpinput/data/inputs/http/http%3A%252F%252Ftest3" rel="alternate"/>

Token "test3" is the one I create via "http-event-collector" command, it could be loaded successfully, but for tokens created via GUI (before disabling splunkdssl), they are still failed to retrieve.

Any ideas why would that happen?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...