×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
dardar
Engager
Member since: ‎04-03-2023
‎04-04-2023
Community Statistics
Posts 2
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎04-03-2023
Activity Feed
View All

Re: Need help to send data Splunk Cloud using HEC

by in Getting Data In
‎04-04-2023 12:10 AM
‎04-04-2023 12:10 AM
@richgalloway thanks for the link. from the link you shared: The standard form for the HEC URI in Splunk Cloud Platform free trials is as follows: <protocol>://http-inputs-<host>.splunkcloud.com:<port>/<endpoint>   The standard form for the HEC URI in Splunk Cloud Platform is as follows: <protocol>://http-inputs-<host>.splunkcloud.com:<port>/<endpoint>   The standard form for the HEC URI in Splunk Cloud Platform on Google Cloud is as follows: <protocol>://http-inputs.<host>.splunkcloud.com:<port>/<endpoint>   Where: <protocol> is either http or https You must add http-inputs- before the <host> on AWS. You must add http-inputs. before the <host> on GCP. <host> is the Splunk Cloud Platform instance that runs HEC You must add the domain .splunkcloud.com after the <host> <port> is the HEC port number 8088 on Splunk Cloud Platform free trials 443 by default on Splunk Cloud Platform instances <endpoint> is the HEC endpoint you want to use. In many cases, you use the /services/collector/event endpoint for JavaScript Object Notation (JSON)-formatted events or the services/collector/raw endpoint for raw events     I'm guessing I should use the "Splunk Cloud Platform free trials" so the URL is: <protocol>://http-inputs-<host>.splunkcloud.com:<port>/<endpoint> 1. what is the <host> ? is it something unique to my account? how do I know what to use? 2. if I'm sending data from a Postman client \ local application (running from my computer) do I need the "http-inputs" part of the URL? 3. since port 8088 is for the free trial - does that means that I should use HTTP? 4. is there a list of <endpoints> I can explore? thanks for any help! ... View more

Need help to send data Splunk Cloud using HEC

by in Getting Data In
‎04-03-2023 08:10 AM
‎04-03-2023 08:10 AM
hi all new to Splunk and its ecosystem I was asked to research it a bit and try to inject data in 2 ways: local file and using REST Api I added local CSV file data to the Splunk Cloud from the "Add data --> Upload" option. so far, so good. now I'm trying to add some data using the HTTP Event Collector options. I defined a new HOC and I have a valid token now. now I got some questions: 1. How do I  actually send the data using Postman or some other HTTP tool ? except for the token I don't even know what URL I should invoke. 2. In what format should I send data? I'm guessing JSON or CSV but I can't find any information about support types and schemas. 3. Is there some sort of full documentation of the API? LIKE, swagger style? since this is only POC I need some help or examples to get me started thanks Amir     ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎04-04-2023 06:37 AM
Karma given to
View All