Getting ECONNRESET Error: socket hang up error

[alok2k5ingh]

Trying to implement the same example as mentioned in the README file but getting the error:
ECONNRESET Error: socket hang up error

Have checkup the token and splunk HEC endpoint, it's working.
Can someone please help

Tried on:
Node version: v14.17.6

"dependencies": {
"splunk-logging": "^0.11.1"
}

[dkoloditch]

+1

[dkoloditch]

@alok2k5ingh Here's an alternate solution using the axios library:

const axios = require('axios');

const splunkCollectorUrl = 'https://<yoursubdomain>.splunkcloud.com/services/collector/event'
const context = {
  event: {
    message: 'hello world'
  },
  sourcetype: 'manual'
};
const axiosOptions = {
  url: splunkCollectorUrl,
  method: 'POST',
  data: context,
  headers: {
    'Authorization': `Splunk ${splunkToken}`
  }
}

axios(axiosOptions);

[bmccleave]

I've hit this issue when attempting publish to splunkcloud as well. I found the removing the port from the url here

splunk-javascript-logging/splunklogger.js

Line 440 in c3795ab

requestOptions.url = this.config.protocol + "://" + this.config.host + ":" + this.config.port + this.config.path;

fixes it.

Here is the current line:

requestOptions.url = this.config.protocol + "://" + this.config.host + ":" + this.config.port + this.config.path;

Changing it to this resolved the issue for me:

requestOptions.url = this.config.protocol + "://" + this.config.host + this.config.path;

This is just a hack. Ideally there would be a configuration option to allow the URL to be explicitly passed without a port

[serdalis]

This issue is because the library is pulling the URL apart and looking for the pieces it needs to reconstruct it when making a request.

The problem is, if it doesn't find a piece it will replace it with the default value. In this case, the default port is 8088.
Changing the url to (note the 443 port):

const splunkCollectorUrl = 'https://<yoursubdomain>.splunkcloud.com:443/services/collector/event'

will fix the issue you're having.

The problem is from these lines:

splunk-javascript-logging/splunklogger.js

Line 235 in c3795ab

config.port = parsed.port;

splunk-javascript-logging/splunklogger.js

Line 257 in c3795ab

ret.port = utils.orByFalseyProp("port", config, ret, defaultConfig);