Hostname or end point url of Splunk enterprise instance

[Kumar_Gana]

Hi Team,

I have recently installed Splunk enterprise free trail  in my pc.

Created and hec event collector and hec token.

I want to send some data to my splunk instance from an external client(system).

But my splunk url shows only http://<IPaddress>:<port>  using which getting connection refused or invalid server.

Can you please suggest how to get the correct host name and url of my splunk system, so that i can trigger data from my client to splunk

thanks,

Kumar

[VatsalJagani]

If you are making the request from some public server. Then you need to specify your machine's public IP there.

In this scenario, you need to have public IP attached to your PC. You can check this from the below URL after you enable the HEC configuration.

https://www.yougetsignal.com/tools/open-ports/

(with your public IP and HEC port number)

If you do not own the static public IP then use the cloud instance like GCP and AWS to install Splunk as they will provide static public IP to use.

Hope this helps.

[Kumar_Gana]

@VatsalJagani 

I clicked on the below given url and i am seeing an IP there saying "your external address".

when i clicked on check by giving hec token port(8088).  It is saying that "port 8088" is closed on given external IP.

I am not sure how attach public IP to my PC.

Regarding, GCP or AWS, you mean installing my splunk enterprise instance on AWS? If yes, can you please provide the documentation on how to do it.

Thanks,

Kumar

[VatsalJagani]

That tells me you are not on static public IP.

Use GCP/AWS to create an EC2 Linux/Windows instance. Do SSH/Windows RDP for logging into it.

* https://cloud.google.com/compute/docs/instances/create-start-instance

* https://docs.aws.amazon.com/efs/latest/ug/gs-step-one-create-ec2-resources.html 

And then use the regular Linux/Windows Splunk installation guide.

* https://docs.splunk.com/Documentation/Splunk/8.2.5/Installation/InstallonLinux 

[venky1544]

Hi @Kumar_Gana 

correct me if i'm wrong as per my understaning  

1) are you looking for the IP of your splunk instance ?

if yes then based on your OS win or linux  you should  run ipconfig or ifconfig to get the ip address 

since this is free trail on your system do check for the firewall issue which i don't think should be there

use curl before testing with 3rd party application if using linux it should have by default if using windows please get a curl.exe and test below command 

curl -k https://localhost:8088/services/collector -H 'Authorization: Splunk 578254cc-05f5-46b5-957b-910d1400341a' -d ''

It will return something like:

{"test":"No data","code":5}

it will check authentication token is correct and working and also check for the connection whereever you run the command and the hec point 

for curl you can use the local host but running from external application use the IP like below

curl -k https://11.11.2222.111:8088/services/collector -H 'Authorization: Splunk 578254cc-05f5-46b5-957b-910d1400341a' -d ''

Hope this helps karma points are appreciated