I am using Windows 7, and I enabled SSL on Splunk Enterprise global setting and created and enabled the HTTP Event Collector (HEC) token. Then I used curl below to send event over using HEC event endpoint, I got the success code, but when I search on Splunk Enterprise UI, the event is not showing (did not get through). And we see SSL errors on auditing log
$ curl -k https://localhost:8088/services/collector/event -H 'Authorization: Splunk 44F774BB-B4FF-4495-BC78-CF25FED6565B' -d '{"event": "hello world SSL"}'
{"text":"Success","code":0}
I also used Postman web client. The http request works fine, but when I use https (enable SSL on HEC), I got the following error, could not get the event sent over successfully. Is there any particular setting in Windows blocking this API?
Could not get any response
This seems to be like an error connecting to https://localhost:8088/services/collector/event. The response status was 0.
Check out the W3C XMLHttpRequest Level 2 spec for more details about when this happens
↧