Add-On calling HEC

twesty — Fri, 22 Feb 2019 16:54:32 GMT

Hi,

I am trying to collect data via a REST API and store it as a metric using the add-on builder and python. Unfortunately you cannot seem to store metric data in Splunk using the default commands available to you and it seems as though you have to go via the HEC which is fine as I can do that... However when it comes to calling the HEC directly, I get a 403 error which seems to indicate its an authorization issue.

I have tested the message I am sending through in curl and it's ingesting fine which makes me think there may be an issue with the SSL certs.

Python Code

method="POST"
url='http://localhost:8088/services/collector'
hec_header={'Authorization': 'Splunk 2ec63ec6-fa0f-499a-8ecf-05b6c0eb4574'}

Response

ERROR403 Client Error: Forbidden for url: http://localhost:8088/services/collector

Any assistance would be much appreciated

Tom

topic Add-On calling HEC in Getting Data In

Add-On calling HEC