topic Re: HTTPS collector not receiving items from scrape? in Splunk Dev

HTTPS collector not receiving items from scrape?

kristjobnext — Fri, 22 Sep 2017 07:30:45 GMT

Using Splunk enterprise. https://45.55.161.5:8000/en-US/app/launcher/home

A HTTPS event collector is listening on 8088 with token DB84F19F-B2F1-4B89-BB38-643DFB641B34

From source, this code is trying to send JSON to Spunk. But Splunk does not receive. Can anyone help to get this right?

Thanks

import requests
import json

url = 'http://45.55.161.5:8088/services/collector/event'
payload = {
"Test": "Splunk ",
}
headers = {
"Authorization": "Splunk DB84F19F-B2F1-4B89-BB38-643DFB641B34",
}
r = requests.post(url, data=json.dumps(payload), headers=headers)
print(r.content)

Re: HTTPS collector not receiving items from scrape?

kristjobnext — Fri, 22 Sep 2017 07:33:21 GMT

btw, it doesn't work with https neither. 'https://45.55.161.5:8088/services/collector/event'

Re: HTTPS collector not receiving items from scrape?

starcher — Fri, 22 Sep 2017 17:53:42 GMT

You could just use a premade HEC python class.
https://github.com/georgestarcher/Splunk-Class-httpevent

But make sure your token is valid in the permissions for the destination index you are wanting to send to.

Re: HTTPS collector not receiving items from scrape?

kristjobnext — Wed, 27 Sep 2017 06:29:06 GMT

Thanks Starcher. I will check this out and let you know.