I'm using HTTP collector on my free trial cloud instance.
URLs I tried:
https://inputs.<MY_SPLUNK_INSTANCE_ID>.splunkcloud.com:8088/services/collector/event/1.0
https://inputs.<MY_SPLUNK_INSTANCE_ID>.splunkcloud.com:8088/services/collector/event
https://inputs.<MY_SPLUNK_INSTANCE_ID>.splunkcloud.com:8088/services/collector
Payloads I tried:
1) {time: -3730851658780559,event: { event: 'test', message: 'localhost event', myts: 1628340011441 }}
2) '{"time":"1628340065.594","event":{"message":"localhost event","severity":"info"}}'
Responses I'd get: { text: 'Success', code: 0 }
Then, I tried these search queries into my Splunk search app, and I get 0 events:
- event.message=*
- event=*
What is happening?
Did you define a HEC token? Are you using the same token in your submissions?
Also, be sure to specify an index name in your search as your default indexes may not include the one in which the HEC events are stored.