topic Re: What are the Unsupported Characters for HEC in Getting Data In

What are the Unsupported Characters for HEC

teixeie — Wed, 16 Sep 2020 21:53:46 GMT

Hi Splunk,

It seems that sending log messages to Splunk HEC endpoints containing "\n", or "\r" or "\t" causes the Hec endpoint to respond... "{"text":"Invalid data format","code":6,"invalid-event-number":0}". Anyone knows where one can find the list of characters that are not permitted ?

Thank you,

Eduardo

Re: What are the Unsupported Characters for HEC

ivanreis — Thu, 17 Sep 2020 07:47:31 GMT

Hi @teixeie , I was doing some research about it and I did not find any document or post that makes reference in how to scape those characters.
I found a document where they mentioned about this error "{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0} and how it can be fixed. The author is using the json format, and maybe it can be applied to your case, it is worth to try.

https://medium.com/adarma-tech-blog/splunk-http-event-collectors-explained-2c22e87ab8d2

Top Tips:

Double-quotes in the JSON Collector
When sending events that contain double-quotes (“”) or nested JSON structures, ie. a stream of text with JSON within “event” key, escape the double-quotes:
before: {“event”:”{“field1”:”value1"}”}
after: {“event”:”{\“field1\”:\”value1\"}”}
OR
before: {“event”:”[15/11/2019 11:00:00]“field1” ”field2"”}
after: {“event”:”[15/11/2019 11:00:00] \“field1\” \”field2\"”}
Otherwise Splunk will reply with:
{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}

If this help, please upvote.

Re: What are the Unsupported Characters for HEC

teixeie — Thu, 17 Sep 2020 16:47:06 GMT

Thank you Ivanreis!

Escaping those characters indeed resolved the issue. I will add escaping for double quotes as well.