topic Re: Is there a way to send JSON data (via HTTPS Post) to Splunk's API without defining an index? in Getting Data In

Is there a way to send JSON data (via HTTPS Post) to Splunk's API without defining an index?

packet_hunter — Fri, 01 Sep 2017 17:34:30 GMT

I am trying to send alerts from an appliance to a Splunk (HF) forwarder.
I have the appliance sending to Splunk's Rest API and I can see data pushed to tcp.port 8089 on the forwarder, but the index and sourcetype are not predefined on the HF. Is there a way for to send the data to the API and pass the index and sourcetype in the Post statement?

Thank you

Re: Is there a way to send JSON data (via HTTPS Post) to Splunk's API without defining an index?

lguinn2 — Fri, 01 Sep 2017 18:02:53 GMT

If you want to send something from an appliance to a heavy forwarder, you might consider using the HTTP Event Collector (HEC) instead. HEC allows the data to include sourcetype, host and index - OR to let that default. If defaulted, the Splunk Admin can specify the index, etc. HEC works well with json data.

Using the HEC also means that the appliance does not need a Splunk username/password to connect. Instead it uses a token which is easy to control.

Here is the Introduction to the HTTP Event Collector.

Re: Is there a way to send JSON data (via HTTPS Post) to Splunk's API without defining an index?

packet_hunter — Tue, 05 Sep 2017 21:25:06 GMT

Thank you for the reply.
I looked into the HEC with Fireeye before and we could not get it to work.
Do you know anyone who successfully setup a fireeye appliance NX, EX, or HX with HEC ?
Thank you

Re: Is there a way to send JSON data (via HTTPS Post) to Splunk's API without defining an index?

sunilpanda023 — Thu, 31 May 2018 01:02:33 GMT

make sure there is no network connectivity issues, its pretty neat and simple.

try from CLI - http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/UseHECfromtheCLI
how to set up - http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/UsetheHTTPEventCollector