I see nothing relevant in those log entries.  I'm afraid I'm out of ideas. ... View more

hi @tcsec2user, If there's no Violation, indexes cannot be blocked, only enabled or disabled and you can enable or disable an index in [Settings -- indexes] or in the indexes.conf file. If you're speaking of blocked indexes for the License Violation, the only way is to ask to Splunk Support an unblock code. Ciao. Giuseppe ... View more

@tcsec2user -  The first call is for HEC which you are doing is correct. I post the data to Splunk cloud using this URL https://localhost:8088/services/collector/event   Then you do a search with the management port: https://localhost:8088/services/search/jobs?search="search *" Two things need to be corrected here: Port needs to be 8089 You said "if I use 8089 as my port number it is not connected to server" This could be due to the management port could be blocked for outside use on the Splunk cloud. I'm not 100% sure. Please check with Splunk Cloud support that I need to use the management port for REST API. Second, "search="search *" is not a param so you need to make a post request and send it as the body.   So start with access to the management port on your Splunk cloud environment, and reach out to Splunk cloud support.   I hope this helps!!! ... View more