About danylan

danylan · ‎06-06-2022

@Roy_9 , ty for reply, i appreciate. I am seeing something different I am on splunk cloud not on enterprise my token is e6a0b67b-e6d0-418f-a2cd-4493804c7c92 I only get a success with the following curl -k -H "Authorization: Splunk e6a0b67b-e6d0-418f-a2cd-4493804c7c92" https://prd-p-gap0o.splunkcloud.com:8088/services/collector/event -d '{"sourcetype": "test", "index": "test", "event": {"message": "Hello world!"}}' #i added -k to allow insecure connection but it does recognize the uri When i try with http-inputs- it fails Note: I am on a trial account by the way.

danylan · ‎06-06-2022

433 was a typo, thanks. After changing with the hyphen it is still complaining about the url formation Url format should match PROTOCOL://HOST:PORT] When following the Splunk docs does it matter if we are on Splunk Cloud Platform or Splunk Enterprise? From the docs it seems the format is a bit different.

danylan · ‎06-03-2022

Hi I am following this documentation from GCP [1], which mentions to omit YOUR_SPLUNK_HEC_URL must not include the HEC endpoint path, for example, /services/collector My question is more specifically related to this section [2], it mentions that format should be <protocol>://http-inputs.<host>.splunkcloud.com:<port>/<endpoint> You must add http-inputs- before the <host> which one would be the correct url, for eg https://http-inputs.xxxx.splunkcloud.com:433 or https://http-inputs-xxxx.splunkcloud.com:433 Send data to HTTP Event Collector on Splunk Cloud Platform [1]https://cloud.google.com/architecture/deploying-production-ready-log-exports-to-splunk-using-dataflow#deploy_the_dataflow_pipeline [2]https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Configure_HTTP_Event_Collector_on_Splunk_Cloud_Platform

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-31-2022

Online Status	Offline
Date Last Visited	‎06-06-2022 11:03 AM

Event collector: What is the correct format in my ...

Re: Event collector

Re: Event collector

Event collector: What is the correct format in my ...