aio app config set log-forwarding not working | Community
Skip to main content
New Participant
May 12, 2022
Solved

aio app config set log-forwarding not working

  • May 12, 2022
  • 2 replies
  • 2239 views

Hello people, i have been trying to make log forwarding to splunk instance that splunk instance seems to be working well (is a splunk cloud trial) and after doing a curl it seems to be working well:

 

 

curl -k https://xyx-y-xxxx.splunkcloud.com:8088/services/collector/event -H "Authorization: Splunk xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -d '{"event": "hello world"}' {"text":"Success","code":0}

 

But when i try to set on App Builder using:

 

$ aio app config set log-forwarding ? select log forwarding destination Splunk HEC ? host xyx-y-xxxx.splunkcloud.com ? port 8088 ? index main ? hec_token [hidden] » Error: Could not update log forwarding settings for namespace 'app-builder-sandbox-instance': 400 (Bad » Request). Error: {"reason":"Validation failed","message":"[Splunk HTTP Error: connect timed out]"}

 

so i still cannot figure out why is this not working it would be glad if someone has been passed through this or a similar situation that could give a clue of where can be the problem

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by YevSen

wrong curl the way i put on my original question (the token is temporary so it will expire after some time).... 

curl -k https://prd-p-uaiyv.splunkcloud.com:8088/services/collector/event -H "Authorization: Splunk 26f05822-ff96-476c-b11b-234e1dcacc0b" -d '{"event": "hello world"}' {"text":"Success","code":0}

it should work.


Anything with `-k` (`--insecure`) will return a "false-positive" result because we don't support self-signed certificates.

 

In other words, even if Splunk allows such connections, we don't allow them from our services to Splunk for security reasons.

2 replies

Employee
May 26, 2022

Hi, @joseluis13 , sorry for the delay. Is there any chance that you can provide host and port (I'd assume that you are still using the same port, which is 8088)?

New Participant
May 26, 2022

is a splunk cloud trial: prd-p-uaiyv.splunkcloud.com:8088

Employee
May 26, 2022
curl https://prd-p-uaiyv.splunkcloud.com:8088
curl: (60) SSL certificate problem: self signed certificate in certificate chain

We don't support self-signed ("insecure") certificates.

tmj
Employee
May 19, 2022

Hey @joseluis13 I have forwarded the question the team. Meanwhile, can you try it with port 443?