https://community.splunk.com/t5/Getting-Data-In/Is-there-an-error-in-the-documentation-My-tests-indicate-the/m-p/613788#M106224 <P>Submit this message as feedback on the relevant Docs page.</P> Tue, 20 Sep 2022 15:11:21 GMT richgalloway 2022-09-20T15:11:21Z https://community.splunk.com/t5/Getting-Data-In/Is-there-an-error-in-the-documentation-My-tests-indicate-the/m-p/613777#M106220 <P>According to my tests the Authorization header should not have a space between the colon and splunk keyword.&nbsp; It should be "Authorization:Splunk ###-####..." and not "Authorization:&nbsp; Splunk ###-####..."</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/FormateventsforHTTPEventCollector" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/FormateventsforHTTPEventCollector</A></P><P>In other words this works:</P><PRE>curl -k https://prd-p.splunkcloud.com:8088/services/collector -H "Authorization:Splunk ###-######" -d "{\"sourcetype\":\"_json\",\"index\": \"job1\",\"event\": {\"a\": \"value1\", \"b\": [\"value1\", \"value1\"]}}"</PRE><P>Whereas this does not work:</P><PRE>curl -k https://prd-p.splunkcloud.com:8088/services/collector -H "Authorization: Splunk ###-######-b680-72c7bd33f9bb" -d "{\"sourcetype\":\"_json\",\"index\": \"job1\",\"event\": {\"a\": \"value1\", \"b\": [\"value1\", \"value1\"]}}"</PRE><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="markjones_0-1663682704498.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21558i5E057FCACB287AAD/image-size/medium?v=v2&amp;px=400" role="button" title="markjones_0-1663682704498.png" alt="markjones_0-1663682704498.png" /></span></P><P>&nbsp;</P> Tue, 20 Sep 2022 14:14:37 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-an-error-in-the-documentation-My-tests-indicate-the/m-p/613777#M106220 mark-jones 2022-09-20T14:14:37Z https://community.splunk.com/t5/Getting-Data-In/Is-there-an-error-in-the-documentation-My-tests-indicate-the/m-p/613788#M106224 <P>Submit this message as feedback on the relevant Docs page.</P> Tue, 20 Sep 2022 15:11:21 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-an-error-in-the-documentation-My-tests-indicate-the/m-p/613788#M106224 richgalloway 2022-09-20T15:11:21Z https://community.splunk.com/t5/Getting-Data-In/Is-there-an-error-in-the-documentation-My-tests-indicate-the/m-p/613796#M106226 <P>Done.</P> Tue, 20 Sep 2022 15:41:51 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-an-error-in-the-documentation-My-tests-indicate-the/m-p/613796#M106226 mark-jones 2022-09-20T15:41:51Z https://community.splunk.com/t5/Getting-Data-In/Is-there-an-error-in-the-documentation-My-tests-indicate-the/m-p/613895#M106248 <P>Hi</P><P>this&nbsp;</P><LI-CODE lang="markup">-H "Authorization: Splunk eae66351-aaaa-1111-2222-2787781f501f"</LI-CODE><P>works as documentation said. Actually you can use it with or without that space between : and Splunk.</P><P>What I have earlier seen, is that in some OS (like windows) and/or some shell configurations will generate some confusion with sending event with curl to HEC. Especially when you are surrounding event with " instead of '. In this first case you must do some escape for " on json field names and values and there are situation when this can leads to unwanted situation.</P><P>r. Ismo</P> Wed, 21 Sep 2022 08:52:41 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-an-error-in-the-documentation-My-tests-indicate-the/m-p/613895#M106248 isoutamo 2022-09-21T08:52:41Z