HEC failed to connect to port 8088

[jip31]

hi

My Splunk server is reachable from :

http://127.0.0.1:8000/fr-FR/app/launcher/home

I try to send data in my splunk server with the curl command below

curl -H "Authorization: Splunk 1f5de11f-ee8e-48df-b4f1-eb1bbb6f3db0" https://localhost:8088/services/collector/event -d '{"event":"hello world"}'

 But I have the message : curl: (7) Failed to connect to localhost port 8088 after 2629 ms: Couldn't connect to server 

Could you help please?

[PickleRick]

Ahhh... so it's windows.

Ok, firstly check if your port is open. You can do that with netstat command from cmd or powershell. I don't remember the right switches to list listening ports for windows version though.

Anyway, if the port was closed, you should get a connection rejected error, not a timeout.

[jip31]

It's strange because i have opened the port 8088 correctly in Windows Defender but when i am running the netstat command i can see it opened....

[PickleRick]

The message says it all - your curl sent SYN packets but never got any reply.

Which means that even if your port is open, it's probably filtered by your local firewall (since you're connecting to loopback device it can't be anything on external network). Check your iptables/firewalld config and open that port so that you can connect.

Whether the port is open by Splunk is another question and you'll see as soon as you "poke a hole" in your firewall.

[jip31]

I have opened the port 8088 in Windows Defender but the result is the same 

Is anybody have an idea?