Auth0-Splunk Integration
Last Updated:
Overview
As per the Splunk community post:
“For Splunk Cloud customers, the standard HEC URI is: https://http-inputs-customer_stack.splunkcloud.com/services/collector If you are using AWS Firehose, then you will have a second HEC URL: https://http-inputs-firehose-customer_stack.splunkcloud.com/services/collector Please note that Splunk Cloud customers do NOT need to specify port 8088, all HEC traffic goes over port 443 (standard SSL). For customers running HEC on their own deployments or using the Splunk test drive instance, then port 8088 will need to be specified: https://input-prd-uniqueid.cloud.splunk.com:8088/services/collector”
We are using the Splunk Cloud instance, and hence, we do not need to specify the port number. Hence, when I execute provided CURL request without the port number, it works.
curl --location --request POST 'https://http-input-XXXXXX.splunkcloud.com/services/collector' \ --header 'Authorization: Splunk <token value> \ --header 'Content-Type: application/json' \ --data-raw '{"event": "Hello, world!", "sourcetype": "manual"}'
Also, when I try to create Splunk integration, it does not allow creating integration without a port number.
There is a mismatch between the CURL request in your document and the community post. Your document is saying to make a Curl request with the Port number, while the community post is saying to make a CURL request without the port number.
