topic Re: Splunk cloud - how to send data using http event collector in Getting Data In

Splunk cloud - how to send data using http event collector

dkgs — Wed, 26 Aug 2020 02:51:33 GMT

Hi,

I am new to using http event collector. I already received the hec token.

I need to send data to splunk cloud , using the provided token.

Any help would be appreciated.

Thanks

Re: Splunk cloud - how to send data using http event collector

richgalloway — Wed, 26 Aug 2020 12:42:00 GMT

https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector_on_Splunk_Cloud_instances

Re: Splunk cloud - how to send data using http event collector

dkgs — Wed, 26 Aug 2020 12:57:15 GMT

@richgalloway Could you please share a sample request which can be sent to test the connectivity from the machine with Splunk Cloud provided the hec token= abcdefghijklmnop

I see a lot of examples, but giving different errors.

It would be great if you can help with an example

Re: Splunk cloud - how to send data using http event collector

richgalloway — Wed, 26 Aug 2020 13:04:08 GMT

I have used HEC, but not in Splunk Cloud so I don't have working examples. There are several examples in the documentation, however. Share the errors you are getting and perhaps someone can suggest a solution.

Re: Splunk cloud - how to send data using http event collector

dkgs — Wed, 26 Aug 2020 13:22:55 GMT

@richgalloway Below is one of the example i saw in the document for splunk cloud.

If the splunk cloud is accessible with the DNS shared by the client, should we add the port 8088 also ?

Also are we executing these from command prompt ? or what other way we can pass the data using hec.

since i am a beginner in using hec, any help would be appreciated

curl -k "https://mysplunkserver.example.com:8088/services/collector" \
    -H "Authorization: Splunk CF179AE4-3C99-45F5-A7CC-3284AA91CF67" \
    -d '{"event": "Hello, world!", "sourcetype": "manual"}'

Re: Splunk cloud - how to send data using http event collector

richgalloway — Wed, 26 Aug 2020 13:38:58 GMT

Yes, curl commands are run from the command prompt. You can send to HEC using any method that performs and HTTP POST action, such as a Python script (See https://github.com/georgestarcher/Splunk-Class-httpevent) or a browser plug-in like POSTER.