We are trying to send data to Splunk HEC via Kinesis Firehose but for some reason Firehose keeps logging "Could not connect to the HEC endpoint. Make sure that the HEC endpoint URL is valid and reachable from Kinesis Firehose." We've tried a combination of the following with no luck: https://hostname.test.com:8088 https://hostname.test.com:8088/services/collector https://hostname.test.com:8088/services/collector/raw We are referencing this post: Power Data Ingestion into Splunk which indicates the first https://hostname.test.com:8088 with a raw endpoint should have worked. I'm able to post events via curl using batch and the raw endpoint and json and the event endpoint. This tells me the ELB is working and forwarding events. So I'm wondering what others have set for their Splunk Cluster Endpoint and Splunk endpoint type in Firehose? Raw Endpoint: curl -k "https://hostname.test.com:8088/services/collector?channel=00872DC6-AC83-4EDE-8AFE-8413C3825C4C" -H "Authorization: Splunk token" -d '127.0.0.1 - admin [28/Sep/2016:09:05:26.875 -0700] "GET /servicesNS/admin/launcher/data/ui/views?count=-1 HTTP/1.0" 200 126721 - - - 6ms 127.0.0.1 - admin [28/Sep/2016:09:05:26.917 -0700] "GET /servicesNS/admin/launcher/data/ui/nav/default HTTP/1.0" 200 4367 - - - 6ms 127.0.0.1 - admin [28/Sep/2016:09:05:26.941 -0700] "GET /services/apps/local?search=disabled%3Dfalse&count=-1 HTTP/1.0" 200 31930 - - - 4ms 127.0.0.1 - admin [28/Sep/2016:09:05:26.954 -0700] "GET /services/apps/local?search=disabled%3Dfalse&count=-1 HTTP/1.0" 200 31930 - - - 3ms 127.0.0.1 - admin [28/Sep/2016:09:05:26.968 -0700] "GET /servicesNS/admin/launcher/data/ui/views?digest=1&count=-1 HTTP/1.0" 200 58672 - - - 5ms' Events Endpoint: curl -k "https://hostname.test.com:8088/services/collector?channel=00872DC6-AC83-4EDE-8AFE-8413C3825C4C" -H 'Authorization: Splunk token' -d '{"event": "Hello"}' ... View more

Is there a way to blacklist or exclude certain RNA events based on values in the data? Right now I have 3 sensors which I do not want connection event data sent to Splunk. I'm able to send these events to the nullqueue using props.conf/transforms.conf to find the string sensor=sensors1.domain.com but I'd love to be able to filter these out at the eNcore level so they aren't even writen to the log file and processed by Splunk. In the configure it appears as though I can exclude by rec_type but is it possible to exclude by other fields? ... View more

I'm trying to chart some phishing logs over time which contain 3 time values: _time - The time when an analyst processed the phishing request. email_received - The time the user received the email time_reported - The time the user reported the email as fishing. I've put together the following search string to change email_received to _time and chart using timechart. The problem is now timepicker doesn't work as expected because it's still using the original _time from the event and not the email_received value. How can I change _time for both the search and the timechart? index=phishme sourcetype=phishme:data | eval _time=strptime(email_received,"%b %d %Y %H:%M:%S") | timechart span=1d count as Reports I've confirmed my eval command is working as expected and email_received is being converted to epoch. ... View more