topic Http Event Collector CURL errors with {"text":"Invalid token","code":4} or "Empty reply from server" using Windows in Getting Data In

Http Event Collector CURL errors with {"text":"Invalid token","code":4} or "Empty reply from server" using Windows

sfortier99 — Fri, 05 Aug 2016 20:29:08 GMT

I configured HTTP Event Collector and am trying to test it with:

curl -k  https://localhost:8088/services/collector/event -H "Authorization: Splunk 8111111111111*"  -d '{"event": "hello world"}'
error:  {"text"."Invalid token","code"4}

I also tried:

curl -k http://localhost:8088/services/collector/event -H "Authorization: Splunk 8111111111111*" -d "{\"event\":\"hello world\"}"

and I get response curl: (52) Empty reply from server

Running Windows Server 2012 R2

Why is this not working?

Re: Http Event Collector CURL errors with {"text":"Invalid token","code":4} or "Empty reply from server" using Windows

somesoni2 — Fri, 05 Aug 2016 20:51:55 GMT

Give this a try (verify the token value is correct and same as what you generated in Splunk)

curl -k  https://localhost:8088/services/collector/event -H 'Authorization: Splunk 8111111111111'  -d '{"event": "hello world"}'

Re: Http Event Collector CURL errors with {"text":"Invalid token","code":4} or "Empty reply from server" using Windows

gblock_splunk — Tue, 16 Aug 2016 05:40:46 GMT

How did you create your token? Did you manually add a stanza to conf? If so which conf file, and can you show the stanza?

If you log into the Splunk UI and go to Settings->Data Inputs->HTTP Event Collector does your token show in the list?

Re: Http Event Collector CURL errors with {"text":"Invalid token","code":4} or "Empty

KrishatSplunk — Mon, 02 May 2022 16:41:20 GMT

If you are using deploment server to create the token and push it to your heavy forwarders where it should be actually authenticate then you have to:
1. To make sure you change useDeploymentServer flag to true as below.

useDeploymentServer = 1

When this option is set to 1 and you make UI-based HEC changes on the deployment server, those changes are placed directly in the $SPLUNK_HOME/etc/deployment-apps/splunk_httpinput/ folder, rather than in $SPLUNK_HOME/etc/apps/folder.

Because if your inputs changes is there in the $SPLUNK_HOME/etc/apps/<anyapp>/inputs.conf on deployment server and also in your Heavy forwarder . Then the rest/curl call to token will end up in Invalid token response code 4.