Connectivity Issue with Splunk HEC Endpoint

[rake]

Hello,

I’m experiencing a connectivity issue when trying to send events to my Splunk HTTP Event Collector (HEC) endpoint. I have confirmed that HEC is enabled, and I am using a valid authorization token.

Here’s the command I am using:

curl -k "https://[your-splunk-instance].splunkcloud.com:8088/services/collector/event" \ -H "Authorization: Splunk [your-token]" \ -H "Content-Type: application/json" \ -d '{"event": "Hello, Splunk!"}'

Unfortunately, I receive the following error:

curl: (28) Failed to connect to [your-splunk-instance].splunkcloud.com port 8088 after [time] ms: Couldn't connect to server

Troubleshooting Steps Taken:

Successful Connection from Another User:

Notably, another user from a different system was able to successfully use the same curl command to reach the same endpoint

Network Connectivity:

I verified network connectivity by using ping and received a timeout for all requests.

I performed a traceroute and found that packets are lost after the second hop.

Despite these efforts, the issue persists. If anyone has encountered a similar issue or has suggestions for further troubleshooting, I would greatly appreciate your help.

Thank you!

[jc01480]

Try removing the port number at the end if you are using Splunk Cloud. This was the issue in my case. The documentation does not reflect this issue as of this writing.

[isoutamo]

Hi

it seems that you have wrong cloud HEC endpoint.

You should use https://http-inputs-<your stack>.splunkcloud.com/<endpoint>.

See more here Send data to HTTP Event Collector

There are some differences based on where and which experience your Cloud Stack is/has.

r. Ismo

[richgalloway]

The ping and traceroute checks confirm a lack of connectivity between your system and your Splunk Cloud stack.  Check your firewall and/or contact your Network Team.