Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

proper configuration for use with splunk light cloud

See original GitHub issue

I’m trying to stream data to my instance of splunk light with the following configuration:

logging:
  splunk-kubernetes-logging:
    secret:
      create: true
    splunk:
      hec:
        host: beep-boop
        insecureSSL: false
        port: 443
        token: vault:darkstore-dev/logging/splunk/hec:token

I get the following error with this configuation:

2019-11-13 19:35:38 +0000 [error]: #0 Failed POST to https://beep-boop.cloud.splunk.com/services/collector, response: <!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta http-equiv="refresh" content="1;url=https://beep-boop.cloud.splunk.com/en-US/services/collector"><title>303 See Other</title></head><body><h1>See Other</h1><p>The resource has moved temporarily <a href="https://beep-boop.cloud.splunk.com/en-US/services/collector">here</a>.</p></body></html>

I’ve tried various configurations, to no avail. I’ve tried not have insecureSSL: false, I’ve tried port: 8089 as well as port: 9997, which is configured for data receive in my Splunk Light cloud UI.

Any tips on getting this to work?

Issue Analytics

State:
Created 4 years ago
Comments:14

Top GitHub Comments

1reaction

mateodelnortecommented, Nov 20, 2019

Yep. Our configuration ended up looking like:

logging:
  splunk-kubernetes-logging:
    secret:
      create: true
    splunk:
      hec:
        host: input-prd-p-[splunk instance id].cloud.splunk.com
        insecureSSL: true
        port: 8088
        token: vault:dev/logging/splunk/hec:token

0reactions

mateodelnortecommented, Nov 20, 2019

Will try. Thanks!

Matt

On Wed, Nov 20, 2019 at 9:29 AM Matthew Modestino notifications@github.com wrote:

just a note, you “SHOULD” be able to use insecureSSL: false as I would assume Splunk Cloud is using trusted certs…just an fyi.

— You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub https://github.com/splunk/splunk-connect-for-kubernetes/issues/285?email_source=notifications&email_token=AAEHOXZOZVTXSO5JZ4HJOBDQUVJT5A5CNFSM4JNAQG42YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEESLTKI#issuecomment-556054953, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAEHOX7O7TRHHSE4QCKR5JTQUVJT5ANCNFSM4JNAQG4Q .