Auth0 Splunk Log Stream Generates Could Not Reach Endpoint Error

When configuring a Splunk log stream in Auth0, a connectivity issue or Transport Layer Security (TLS) problem causes an endpoint error. Resolving this involves verifying the TLS certificate, testing local connectivity, and using a cURL command to test the webhook payload outside of Auth0.

When setting up a Splunk log stream, Auth0 generates the following error:

Could not reach endpoint

• Auth0
• Splunk
• Log Streams

The error indicates a connectivity problem and does not occur if the Splunk token has the correct configuration or if the server returns an HTTP status code. This error only occurs when the connection times out or when a TLS problem exists.

How is the Splunk log stream connectivity issue resolved?

To resolve the connectivity issue, verify the certificate, test the local connection, and execute a cURL command to test the webhook by following these steps:

1. If the configuration uses the Verify TLS setting, ensure the certificate is valid.

2. For Private Cloud environments, check the connectivity from a local machine. If the local machine establishes a connection, the instance likely has a connectivity problem. Contact the Support Team to check the connectivity.

3. If the configuration uses a custom webhook, test the connectivity outside of Auth0 using the same payload URL. To test the connectivity outside of Auth0 and send an event to the HTTP Event Collector (HEC), execute the following cURL command:

curl "https://http-inputs-mysplunkserver.splunkcloud.com:8088/services/collector%22 \
    -H "Authorization: Splunk CF179AE4-3C99-45F5-A7CC-3284AA91CF67" \
    -d '{"event": "Hello, world!", "sourcetype": "manual"}'

4. If the cURL test succeeds but the connection still fails in Auth0, contact the Support Team to check the connectivity.