Hi @thefuzz4 First off, thanks for using HEC! Looking at the example above, it does not appear to be in the proper format for our JSON Event protocol. The format requires you to have a JSON envelope which contains within it an "event" field with the value being your payload. You should also include a epoch timestamp as HEC doesn't do timestamp extraction from the JSON. So looking at your example the JSON payload below in the curl I provided should work (assuming HEC is enabled). I tested this and it worked against my HEC instance. curl -k https://localhost:8088/services/collector -H 'Authorization: Splunk 16229CD8-BB6B-449E-BA84-86F9232AC3BC' -d ' {"event":{"date":"Sat Feb 13 21:20:44 UTC 2016","name":"power","displayName":"Home Energy","device":"Home Energy","deviceId":"31ea905e-28d3-4779-a8b1-82bcd528c520","value":"2233","isStateChange":"true","id":"a4b491a0-d297-11e5-897c-22000bb6c3f8","description":"zw device: 0F, command: 3202, payload: 21 74 00 22 11 C0 00 00 00 00 00 00","descriptionText":"Total Power: 2233 Watts","installedSmartAppId":"null","isoDate":"2016-02-13T21:20:44.892Z","isDigital":"false","isPhysical":"false","location":"Home","locationId":"846d6e0a-dcc0-44e8-a09b-bac269bfa6c1","unit":"W","source":"DEVICE"},"time":1455398444892}' Main difference above is that I've enclosed your event in "event". I've removed the extra brace at the end (as that made the JSON invalid), and I've added an epoch time stamp which I got by converting the isoDate field above. Let me know if this works for you. ... View more

Hi @mbintz Great to hear you are using HEC. By default the host will be the host set to the server host. To change this you can set the connection_host setting in etc\apps\splunk_httpinput\inputs.conf . It will allow you to select to use the client IP. You can set this either globally at the [http] stanza level or for each individual token within the token stanza. Here is the setting from inputs.conf.spec connection_host = [ip|dns|none] * Specify the host if an event doesn't have host set. * "ip" sets the host to the IP address of the system sending the data. * "dns" sets the host to the reverse DNS entry for IP address of the system sending the data. * "none" leaves the host as specified in the HTTP header. The default is none. ... View more

Hi @simpkins1958. You can now enable HTTP Event Collector yourself in Trial / Single Instance. Go to Settings->Data Inputs->HTTP Event Collector from there you can enable the collector and create a token. In order to create requests, you need to prefix the URI of your cloud instance with "input-", i.e. see the curl below curl -k https://input-prd-p-j65vnzzl9wc8.cloud.splunk.com:8088/services/collector -H 'Authorization: Splunk 498FEC9B-86E2-4CD0-B489-4A55E2D52B07' -d '{"event":"event1"} {"event":"event2"}' Notice I've added "input-" then the instance. Also the port + /services/collector endpoint are there. As a side note, Splunk Cloud trial uses a self-signed cert, so you need to disabled cert validation if using HTTPS which is what the '-k' switch does with curl. Let me know if you have any issues. Thanks Glenn ... View more