Splunk Enterprise

How do I access my local Splunk enterprise to receive incoming webhooks from the internet?

s_palan
New Member

I have installed free Splunk enterprise in my local system and It can be accessed via localhost:8000
I have also configured the webhook receiver in this instance to run at port 8088 via the HTTP event collector settings

I tried ngrok to expose localhost:8000 and localhost:8088 and use that public URL as a webhook listening server. But Splunk is not receiving any events. I can see my ngrok server being hit with the events but seems like it's not able to forward it over to splunk.

what am I doing wrong here? What's the right way to expose my localhost Splunk instance to start receiving these webhook events?

Thank you in advance for help!
Webhooks Input #splunklocalhost

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Are you sure you're using the webhook inputs app or did you just configure a HEC input?

2. Whatever that ngrok is - since you said that Splunk is listening on localhost - is it running on the same machine?

3. Did you verify if that ngrok is connecting to your Splunk instance and sending data?

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...