What is the default port for sending data via HTTP Event Collector to Splunk Cloud?

The default port for sending data to Splunk Cloud Platform via the HTTP Event Collector (HEC) is 443. Splunk Cloud utilizes this standard HTTPS port to ensure all data transmission is encrypted and secure. Using port 443 also simplifies network and firewall configurations for customers connecting to the cloud service, as it is a commonly allowed port for outbound web traffic. While Splunk Enterprise uses a different default port (8088), the cloud platform standardizes on 443 for HEC.

B. 8088: This is the default HEC port for Splunk Enterprise (on-premises) deployments, not for the Splunk Cloud Platform.

C. 9997: This is the default port for receiving data from Splunk forwarders using the Splunk-to-Splunk (S2S) protocol.

D. 8000: This is the default port for accessing the Splunk Web user interface, not for data ingestion via HEC.

1. Splunk Documentation, Getting Data In manual, "Set up and use HTTP Event Collector in Splunk Web". In the section "Enable HEC," the documentation explicitly states: "For Splunk Cloud Platform, HEC is enabled by default... The default port for HEC is 443."

2. Splunk Documentation, Getting Data In manual, "About HTTP Event Collector". Under the "How HEC works" section, it clarifies the distinction: "In Splunk Cloud Platform, HEC runs on the cluster's inputs and processing tier and listens for HEC requests on port 443."

3. Splunk Documentation, Admin Manual, "Enable and configure HTTP Event Collector". This document confirms the default for on-premises deployments, helping to differentiate from Splunk Cloud: "By default, the Splunk software enables HEC on port 8088."