Splunk Dev

Accessing HEC with Java getting error Failed to connect to hecdevsplunk.company.com/11.54.0.234:8088

steveIMS
Engager

Using Java Class HttpEventCollectorLoggingHandler, with properties file, implementing the HttpEventCollectorErrorHandler.

The Reply; Error Code and Error text from HttpEventCollectorErrorHandler is:

Reply: Failed to connect to hecdevsplunk.company.com/11.54.0.234:8088
ErrorCode: -1
ErrorText: com.google.gson.stream.MalformedJsonException: Use JsonReader.setLenient(true) to accept malformed JSON at line 1 column 9 path $
Failed write of Log Event: Failed to connect to hecdevsplunk.company.com/11.54.0.234:8088
HttpEventCollectorErrorHandler

Any assistance would be appreciated, Thanks Steve.

Tags (1)

struffieux
Engager

Hi,

I have the same error.:

om.splunk.logging.HttpEventCollectorErrorHandler$ServerErrorException: com.google.gson.stream.MalformedJsonException: Use JsonReader.setLenient(true) to accept malformed JSON at line 1 column 7 path $

Something new about it?

0 Karma

struffieux
Engager

It seems in case of error by send event that HttpEventCollectorSender will instantiate a ServerErrorException:

 HttpEventCollectorErrorHandler.error(events, new ServerErrorException(ex.getMessage()));

And ServerErrorException try to parse the message as JSON (!):

        public ServerErrorException(String serverReply) {
            this.reply = serverReply;

            try {
                JsonObject json = JsonParser.parseString(serverReply).getAsJsonObject();
                this.errorCode = json.get("code").getAsLong();
                this.errorText = json.get("text").getAsString();
            } catch (Exception var3) {
                this.errorText = var3.getMessage();
            }

        }

So this error is not the original error.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...