Customers setting up an HEC connection https://docs.splunk.com/Documentation/Splunk/8.2.4/Data/UsetheHTTPEventCollector with Spinnaker Logging may encounter an issue where data is not being pushed to the connector

HEC connector with default ports uses 8088 or 8089 depending on the Splunk version by default.  This will happen if you do not configure a TCP listener, and can cause issues in Splunk with attaining data if the port is already in use

It is recommended that customers define a unique port for ingesting data from Spinnaker into Splunk using HEC.  The port can be defined within the setup of the HEC collector

See Step 10 of Enable HTTP Event Collector on Splunk Enterprise Step in the Splunk documentation https://docs.splunk.com/Documentation/Splunk/8.2.4/Data/UsetheHTTPEventCollector

2.26.x