I cannot figure out which component to enable HEC and where to send the events. We have an on prem Splunk Enterprise distributed configuration with a Deployment server, Indexer and SearchHead. We also have an independent "sandbox" environment for testing where I'm trying to set this up. Sandbox is 1 server with the whole Splunk Enterprise installation, however we do use the deployment server to setup and configure the sandbox universal forwarders, etc. I setup HEC tokens on the sandbox and could not figure out how to get it working. I am testing using Curl commands. I then added HEC tokens on the deployment server and still testing with Curl, cannot figure out how to send events to it. I get these errors: 1) Sending curl to sandbox URL with either deployment server HEC token or sandbox HEC token "The requested URL was not found on this server.","code":404 2) Sending curl to indexer URL with either deployment server HEC token or Sandbox HEC token Failed to connect to spidxa.open-techs.local port 8088: Connection refused 3) Sending curl to deployment server URL with either deployment server HEC token or Sandbox HEC token Failed to connect to spmgta.open-techs.local port 8088: Connection timed out 4) Sending curl to SearchHead URL with either deployment server HEC token or Sandbox HEC token, and this is likely a firewall issue, but it doesn't make sense to me to send the event to the search head, so I haven't pushed security to open this port. Failed to connect to spsha.open-techs.local port 8088: No route to host This is my curl command with escaped double quotes and {variable substitutions} curl -g -k --location --request POST 'https://#{server I am testing}:8088/services/collector/event' --header "Authorization: Splunk {token}" --header "Content-Type: text/plain" --data-raw "{\"event\": \"Test kong_dev\"}" Can anybody tell me which components do which part of the HEC event collection? The introspection\http_event_Collector_metrics.log on both deployment and sandbox just show one minute intervals of 0 transactions going through there.
... View more
