Prisma Cloud: 400 Error - Splunk Integration
8577
Created On 07/06/22 16:56 PM - Last Modified 01/09/23 20:28 PM
Symptom
400 error: Something went wrong. Please contact your Prisma Cloud support team
Environment
- Prisma Cloud
- Integration
- Splunk
Cause
Incorrect Splunk HTTP event collector URL but Prisma Cloud doesn't specify what's wrong when configuring a Splunk integration.
GUI: Prisma Cloud Console > Settings > Integrations > Add Integration > Select Splunk from the dropdown > Summary
GUI: Prisma Cloud Console > Settings > Integrations > Add Integration > Select Splunk from the dropdown > Summary
- Log in to Prisma Cloud and navigate to Integrations, GUI path: Settings > Integrations
- Click on the Add Integration button and select "Splunk"
- Fill out all the required fields for your Splunk integration
- Click Next and proceed to the Summary page
- Click on the Test button to test your integration. "400: Something went wrong.." error message is displayed/
Resolution
- Navigate to Developer Tools on your browser (For example on Chrome: click on 3 dots on the top right > More tools > Developer tools)
- Click on the Network tab in your Developer Tools
- Now click the Test button to record API calls made by Prisma Cloud
- Click on the test API call highlighted in red
- Click on response tab in the Developer Tools
- The response above indicates that the Splunk HTTP event collector URL has an incorrect format
- Fix the Splunk HTTP event collector URL to follow the correct format shown in the response returned for the test API call
- Now click the test button to make sure that your integration is functional
Additional Information
Splunk Integration
Google Chrome is the recommended browser for Prisma Cloud.