Splunk Enterprise

Trying to get Fluentbit logs to send through HEC, but getting error?

xRusty9
Engager

Hi there, appreciate if anyone could help me with these query.

I am trying to pump local file to splunk using fluentbit. The Splunk is currently https and secure.

I kept encountering error message of unexpected EOF, I am not sure what have I done wrongly in the fluent-bit.config file.

 

cmd-fluentbit-3nov.png

 

This is the screenshot of the splunk's general settting

GeneralSetting in Splunk.png

 

Below is the fluent-bit.config that I used with the fluent-bit.exe..

Spoiler
[INPUT]
Name tail
Tag taglog
Path C:\*.json

[OUTPUT]
Name splunk
Match *
Host localhost
Port 443
Splunk_Token <The HTTP Event Collector token generated in Splunk Web>
TLS On
TLS.Verify On
http_user <The username login to Splunk Web>
http_passwd <The password used to login to Splunk Web>
splunk_send_raw On

 

 

when i set the "TLS.Verify" to Off, it will have 303 http status code

303 error.png

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...