This article provides a solution to the following error that occurs when configuring a Log Stream with Splunk.

HTTP request to exceeded 5 seconds limit

• Log Streams
• Splunk

The error is caused by an incorrect domain configuration for the Splunk Log Stream. The domain is often missing the required http-inputs- prefix.

To resolve this error, correct the domain configuration by following these steps:

1. Navigate to the Log Stream settings for Splunk.
2. Locate the Domain field.
3. Ensure the domain includes the http-inputs- prefix. The correct format is:

• • http-inputs-<host>.splunkcloud.com

4. For additional troubleshooting, refer to the Splunk Troubleshooting Guide for HEC.
5. Save the changes.