topic Re: POST request using Http Event Controller to Splunk Enterprise - Issue with documentation in Splunk Dev

POST request using Http Event Controller to Splunk Enterprise - Issue with documentation

priyankatiwari — Tue, 29 Sep 2020 19:17:10 GMT

Hello Splunk experts,
I have been experimenting with the Http Event Controller for Splunk Enterprise and was trying to POST , JSON data, with the 'fields' parameter in order to allow better indexing.
I am using this http://dev.splunk.com/view/event-collector/SP-CAAAFB6
The request is:
curl -k https://mysplunkserver.example.com:8088/services/collector/event -H "Authorization: Splunk 12345678-1234-1234-1234-1234567890AB" -d '{"event": "Hello, McKinley High!", "sourcetype": "_json", "fields": {"club":"glee", "wins",["regionals","nationals"]}}' . However, this results in an error in the logs:
ERROR JsonLineBreaker - JSON StreamId:0 had parsing error:Unexpected character while looking for value: 'H' - data_source="http:force_ocr", data_host="localhost:8088", data_sourcetype="_json"
Is the example in the splunk documentation incorrect? What is the right way to use the 'fields' parameter?
Thank you for helping out here!

Re: POST request using Http Event Controller to Splunk Enterprise - Issue with documentation

xpac — Sun, 29 Apr 2018 10:47:27 GMT

Could you give the link to the example in the docs?

Re: POST request using Http Event Controller to Splunk Enterprise - Issue with documentation

Jason_S — Fri, 08 Feb 2019 08:25:05 GMT

Found this question while researching a "ERROR JsonLineBreaker" "Unexpected character" events in my Splunk. I tried to re-create the error using Splunk 7.1.2 but the provided curl command fails due invalid JSON.

curl -k https://localhost:8088/services/collector/event -H "Authorization: Splunk ${TOKEN}" -d '{"event": "Hello, McKinley High!", "sourcetype": "_json", "fields": {"club":"glee", "wins",["regionals","nationals"]}}'
{"text":"Invalid dataformat","code":6,"invalid-event-number":0}

"wins" is followed by a "," when it should be a ":". Correcting the issue yields a "Success" message w/ no "ERROR JsonLineBreaker" logged.

curl -k https://localhost:8088/services/collector/event -H "Authorization: Splunk ${TOKEN}" -d '{"event": "Hello, McKinley High!", "sourcetype": "_json", "fields": {"club":"glee", "wins": ["regionals","nationals"]}}'; echo
{"text":"Success","code":0}

FWIW, the JSON typo came from Splunk's "Explicit JSON fields" example at:

http://dev.splunk.com/view/event-collector/SP-CAAAFB6