topic Re: HTTP Event Collector- Is there something wrong with this curl command? in Splunk Cloud Platform

HTTP Event Collector- Is there something wrong with this curl command?

splunkerhtml — Fri, 15 Dec 2023 15:29:39 GMT

Currently trying to test an HTTP event collector token by directly sending events to the cloud before we use the HEC for a OpenTelemetry Connector, but we are getting stuck at 403 Forbidden error. Is there something wrong with this curl command?

Not sure if it affects anything but we are still on the Splunk Cloud Classic

Screenshots attached, appreciate any help we can get!

Re: HTTP Event Collector- Is there something wrong with this curl command?

richgalloway — Fri, 15 Dec 2023 19:38:24 GMT

Error 403 means the token is incorrect or disabled. Check that the curl command has the right token.

Re: HTTP Event Collector- Is there something wrong with this curl command?

inventsekar — Fri, 15 Dec 2023 21:59:02 GMT

For those who like to learn the different error codes and their details:

Possible error codes

The following status codes have particular meaning for all HTTP Event Collector endpoints:

Status code HTTP status code ID HTTP status code Status message

0	200	OK	Success
1	403	Forbidden	Token disabled
2	401	Unauthorized	Token is required
3	401	Unauthorized	Invalid authorization
4	403	Forbidden	Invalid token
5	400	Bad Request	No data
6	400	Bad Request	Invalid data format
7	400	Bad Request	Incorrect index
8	500	Internal Error	Internal server error
9	503	Service Unavailable	Server is busy
10	400	Bad Request	Data channel is missing
11	400	Bad Request	Invalid data channel
12	400	Bad Request	Event field is required
13	400	Bad Request	Event field cannot be blank
14	400	Bad Request	ACK is disabled
15	400	Bad Request	Error in handling indexed fields
16	400	Bad Request	Query string authorization is not enabled

more info on HEC troubleshooting:

https://docs.splunk.com/Documentation/Splunk/9.1.2/Data/TroubleshootHTTPEventCollector

thanks, have a great day!

Re: HTTP Event Collector- Is there something wrong with this curl command?

splunkerhtml — Mon, 18 Dec 2023 08:11:54 GMT

My token is valid, I tried with 2 differents token created 😞

Re: HTTP Event Collector- Is there something wrong with this curl command?

PickleRick — Mon, 18 Dec 2023 08:37:35 GMT

Well, your HEC input disagrees with you.

If your data was wrong you'd get a different code (typically a round 400).

403 means that your token doesn't match the allowed tokens.

Re: HTTP Event Collector- Is there something wrong with this curl command?

splunkerhtml — Mon, 18 Dec 2023 08:42:50 GMT

Is this perhaps due to some configuration here, no?

Re: HTTP Event Collector- Is there something wrong with this curl command?

PickleRick — Mon, 18 Dec 2023 10:42:12 GMT

Might be. I'm not very strong on Cloud.

Re: HTTP Event Collector- Is there something wrong with this curl command?

splunkerhtml — Mon, 18 Dec 2023 13:55:18 GMT

Hello, I tested my curl is now working but I always get this error with Mulesoft HEC

Re: HTTP Event Collector- Is there something wrong with this curl command?

inventsekar — Tue, 19 Dec 2023 00:00:23 GMT

Hi @splunkerhtml, may i know, after creating the token, did you do copy-paste ?!?!
after pasting, maybe, thee is a chance that, you included a space and entered ?!?! (many times many of my friends faced this issue!)
just double check the token created and copy pasted, then update us, thanks.

or, is this a production project?.. then you may contact Splunk Cloud Support. they should be able to help you.

Upvotes / karma points are appreciated by everybody, thanks.