No HTTP response from Splunk when sending data

bruceclarke — Tue, 26 May 2015 17:22:08 GMT

All,

I'm trying to curl data to my Splunk indexer. The data is getting there, but I'm never receiving a response from Splunk that the data was received. This is causing issues, since I can't tell if the data was forwarded correctly. I receive a response from Splunk when I issue POSTs for searches, so this is NOT a connection issue.

Here is the curl command I'm issuing to a TCP enabled port. Like I say, the data is getting to Splunk, but I don't receive any response. Why might this be?

curl -k "http://MySplunkIndexer:515/services/receivers/simple" -d "Testkey=TestValue"

Thanks!

Re: No HTTP response from Splunk when sending data

acharlieh — Tue, 26 May 2015 18:09:51 GMT

A TCP input, is simply that. It is a lower level than HTTP. A tool like netcat is more appropriate for testing sending data over TCP.

However it looks like you're attempting to use the Splunk REST API to send data. This goes over the Splunk management port (By default your URL should be: https://yourSplunkIndexer:8089/services/receivers/simple ) It's been a while since I've played with the REST API to send data, but you may or may not need to authenticate for this endpoint as well.

topic Re: No HTTP response from Splunk when sending data in Getting Data In

No HTTP response from Splunk when sending data

Re: No HTTP response from Splunk when sending data