Why getting timeout error while adding data to the Splunk cloud index from REST API?

[krishnabv]

Hello Team,

I am getting timeout error while adding data to Splunk cloud index from REST API. I am using below endpoint. (or) help me how can i add data to Splunk cloud index through REST API's.

URL : http://*********:8088/services/collector

Thanks,
Venkata.

[Roy_9]

Hi @krishnabv 

Can you share the url syntax with some dummy names to just understand the format that you are using?

Splunk cloud HEC end point varies for both self and managed service cloud, just wanted to make sure.

Thanks

[isoutamo]

This should works also with SC with correct host part in URL.

curl -vk -u "x:aea66351-b931-4be1-83fa-2787781f501f" https://localhost:8088/services/collector/event -d '{"sourcetype": "mysourcetype", "event": "Hello, world!"}'

You should also see this https://www.aplura.com/assets/pdf/hec_pipelines.pdf to understanding how events are managed based on used endpoint. There are also a newer version of this picture, but I don't know if it's a public or not? @dshpritz knows the situation of it and maybe he could tell when it can published?

Aplura has some other excellent Cheat Sheets for us! Thanks @dshpritz & co!

[krishnabv]

Hi @isoutamo ,

i am testing from POSTMAN(Which is 3rd party app), does it work.

Thanks,
Venkata.

[krishnabv]

Hi @Roy_9 

i am using this URL : http://*********:8088/services/collector

Thanks,
Venkata

[isoutamo]

Hi

did this help you https://community.splunk.com/t5/Getting-Data-In/HEC-troubleshooting-in-distributed-Enterprise-enviro... ?

If there is still timeout you should use curl -v to see verbose logging. And if/when needed ask Splunk Support to enable HEC on your stack if it haven't enabled yet.

r. Ismo

[krishnabv]

Hi @isoutamo ,

I am trying below and it is working fine in splunk enterprise and it is not working in Splunk cloud. could you help me on this.

krishnabv_0-1656494018669.png

Thanks,
Venkata

[krishnabv]

Hi @isoutamo 

How can i check whether HTTP event collector is enabled or not in Splunk cloud.

Thanks,
Venkata