Universal Forwarder not sending logs to Splunk Cloud via HEC

Applicability

Description

When trying to send VM logs from an Universal Forwarder(UF) via HEC to Splunk Cloud directly, UF is getting errors regarding connection and bad gateways and no logs are getting into Splunk Cloud:

08-19-2025 21:48:39.492 +0000 ERROR S2SOverHttpOutputProcessor [9329 parsing] - HTTP 502 Bad Gateway

Investigation

Step 1: Since the UF had no direct access to internet without a proxy, verified that the proxy setting were not blocking the Splunk cloud domain or similar:

[proxyConfig]
http_proxy = http://<proxy_url>
https_proxy = http://<proxy_url>
proxy_rules = *.splunkcloud.com

Step 2: Verified that the inputs.conf were configured correctly and the monitor stanza had the correct directory of the desired logs.

Step 3: Verified that the outputs.conf had the right HEC token and URI configured. In this case, the URI was indicated with the HEC endpoint, which is not the syntax indicated in the official documentation: Configure forwarding with outputs.conf

[httpout]
httpEventCollectorToken = <HEC token encrypted>
uri = https://http-inputs-<stack_name>.splunkcloud.com/services/collector/event

Resolution

Make sure to use the correct URI as the documentation states the syntax: 

[httpout]
uri = https://http-inputs-<stack_name>.splunkcloud.com:443

Related Links

Configure forwarding with outputs.conf