Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Why is HTTP Event Collector listening only on 127....
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I enabled the HTTP Event Collector and I can see on my Centos 7 by running the ss -an command that it is listening only on 127.0.0.1 address. As a result the curl is working when calling 127.0.0.1:8088 and connection is refused when calling :8088 from the local ssh terminal
Any idea how to fix this issue?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I solved it. My free splunk is deliberately set to be accessible only from localhost because user authentication can be done only through an NGINX reverse proxy. Hence the listening limitation.
I added a second reverse proxy setting for the HTTP Event Collector and all is working fine now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I solved it. My free splunk is deliberately set to be accessible only from localhost because user authentication can be done only through an NGINX reverse proxy. Hence the listening limitation.
I added a second reverse proxy setting for the HTTP Event Collector and all is working fine now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think I'm having a similar issue, we have an Apache2 reverse proxy in front of our Splunk instance, what type of setting did you configure to allow the HEC explicitly?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[root@splunk ~]# firewall-cmd --list-all
public (default, active)
interfaces: eth0
sources:
services: dhcpv6-client ssh
ports: 443/tcp 80/tcp 2222/tcp 4443/tcp 8886/tcp 8088/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
