topic Re: Splunk HEC: Python post requests fails with 401 Unauthorized client error while cURL requests are fine in Getting Data In

Splunk HEC: Python post requests fails with 401 Unauthorized client error while cURL requests are fine

spervez — Wed, 16 Oct 2019 01:20:25 GMT

I have created a python script to post json data to Splunk:

splunk_ep = 'https://xxx:8088/services/collector/event'
SPLUNK_TOKEN = os.getenv('SPLUNK_TOKEN')
auth_header = {'Authorization': SPLUNK_TOKEN, 'Content-Type': 'application/json'}

def SendToSplunk(data):
        response = requests.post(splunk_ep, json=data, headers=auth_header, verify = False)
        print(response)

It returns following error:
401 Client Error: Unauthorized for url: https://xxx:8088/services/collector/event

However, If use cURL with above params, it works fine. Please advise.
Thanks

Re: Splunk HEC: Python post requests fails with 401 Unauthorized client error while cURL requests are fine

renjith_nair — Wed, 16 Oct 2019 11:09:43 GMT

@spervez,

In the authorization header, you need to add the Splunk keyword "Authorization: Splunk <hec_token>" . If your environment variable does not have this, try adding the keyword.

Re: Splunk HEC: Python post requests fails with 401 Unauthorized client error while cURL requests are fine

starcher — Wed, 16 Oct 2019 12:34:09 GMT

You could also use a pre-made HEC class.
https://github.com/georgestarcher/Splunk-Class-httpevent

Re: Splunk HEC: Python post requests fails with 401 Unauthorized client error while cURL requests are fine

spervez — Thu, 17 Oct 2019 22:59:53 GMT

Hi Renjith,
Thanks for coming back.

I have resolved the issue and it was a stupid error I was making in using keyword SPLUNK instead of Splunk.

Regards

Re: Splunk HEC: Python post requests fails with 401 Unauthorized client error while cURL requests are fine

renjith_nair — Fri, 18 Oct 2019 13:41:43 GMT

@spervez, glad its working. If you think the above answer helped you to resolve the issue, accept/upvote.
Also try the class mentioned by George below. That will definitely help you to get going.