Splunk Enterprise

How do I access my local Splunk enterprise to receive incoming webhooks from the internet?

s_palan
New Member

I have installed free Splunk enterprise in my local system and It can be accessed via localhost:8000
I have also configured the webhook receiver in this instance to run at port 8088 via the HTTP event collector settings

I tried ngrok to expose localhost:8000 and localhost:8088 and use that public URL as a webhook listening server. But Splunk is not receiving any events. I can see my ngrok server being hit with the events but seems like it's not able to forward it over to splunk.

what am I doing wrong here? What's the right way to expose my localhost Splunk instance to start receiving these webhook events?

Thank you in advance for help!
Webhooks Input #splunklocalhost

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Are you sure you're using the webhook inputs app or did you just configure a HEC input?

2. Whatever that ngrok is - since you said that Splunk is listening on localhost - is it running on the same machine?

3. Did you verify if that ngrok is connecting to your Splunk instance and sending data?

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...