Connection error between Log Observer Connect (LOC) and Splunk Enterprise

Available Languages

Updated:September 29, 2026
Document ID:SPLK047354

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Observability Cloud (Splunk Log Observer Connect) -- Load balancer/Reverse Proxy -- Splunk Enterprise

Description

Connection error between Log Observer Connect and Splunk Enterprise cannot be successfully established to Splunk Enterprise because other than the standard egress port 8089 is configure in filed "Splunk platform URL" on Set Up Observability Cloud page.  All configuration on Splunk Enterprise is configured properly.

 

During  Log Observer Connect set up an error  message show up:

Unable to fetch index count due to: {"HTTPStatusCode":400,"HTTPStatus":"None provided","Message":"SplunkLogs HTTP Error "}

Below architecture with Load Balancer/Reverse Proxy in which this issue can show up.

 

Failed configuration

 

Example 1.  Please note Splunk platform URL is configured to port 28089 (not 8089) exposed on Load Balancer/Reverse  Proxy.  

 loc-se-sh-not-ok-b.png

Example 2.  Please note Splunk platform URL is configured to port 443 (not 8089) exposed on Load Balancer/Reverse  Proxy.  

loc-se-sh-not-ok-a.png


Investigation

  1. Check configured port in in filed Splunk platform URL on Set Up Observability Cloud page.
    loc_config_failed.png 
  2. Check if exposed port on Load Balancer/Reverse Proxy is configure to something else than 8089 as on diagram Failed configuration in the Description section.

Resolution

  1. Confirm if exposed port on Load Balancer/Reverse Proxy is configure to port 8089.  If needed modify configuration.  Below working example:
    loc-se-sh-ok-a.png loc-se-sh-ok-b.png 
  2. Configured port in in filed Splunk platform URL on Set Up Observability Cloud page e.g.: https://loadbalancer_my_company.com:8089
    loc_config_ok.png 

  1. Set up Log Observer Connect for Splunk Enterprise
  2. Recorded video how to Setting Up Log Observer Connect

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles