topic Re: What date format does splunk HTTP Event Collector use? in Getting Data In

What date format does splunk HTTP Event Collector use?

mark-jones — Tue, 20 Sep 2022 05:21:55 GMT

I want to parse local log files and add the date to the body of the post request, but not exactly certain what is the best date form at to use? Can someone please provide some example options?

Thank You,

Mark

$params = @{
    Uri = 'https://prd-p.splunkcloud.com:8088/services/collector'
    Method = 'POST'
    Headers = @{
        Authorization = 'Splunk 2caf8cde'
    }
    Body   = @{
        index = 'job1'
        sourcetype = '_json'
        event      = @{
            name1 = "value1"
            name2 = "value2"
            array1 = @(
                "value1"
                "value2"
            )
        }
    } | ConvertTo-Json
}
Invoke-RestMethod -SkipCertificateCheck @params

Re: What date format does splunk HTTP Event Collector use?

venkatasri — Tue, 20 Sep 2022 05:38:05 GMT

Hi @mark-jones

https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/FormateventsforHTTPEventCollector#Event_metadata

You could take a look at this link and there are examples deep links to follow inside.

Hope it helps!

Re: What date format does splunk HTTP Event Collector use?

bowesmana — Tue, 20 Sep 2022 05:45:05 GMT

Add a "time" field with epoch time

See here

https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/FormateventsforHTTPEventCollector

You should probably use

services/collector/event

https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/HECRESTendpoints