topic Re: Sending Json output via CURL in Getting Data In

Sending Json output via CURL

vickymanoignis — Tue, 25 May 2021 19:34:49 GMT

I m just trying to feed the AWS instance data to Splunk, the output for "aws ec2 describe-instances" is in json format and i m placing the result to a variable. now i m trying to call the variable in curl command

asset = aws ec2 describe-instances
echo $asset
curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d {"sourcetype": "some-fields", "fields":'$asset'}"

and output seems like

curl: (6) Could not resolve host: "disabled"

curl: (3) [globbing] unmatched close brace/bracket in column 1

could some one give a better solution?

Re: Sending Json output via CURL

kamlesh_vaghela — Wed, 26 May 2021 04:16:18 GMT

@vickymanoignis

Have you tried this?

curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d '{"sourcetype": "some-fields", "fields":"$asset"}'

Re: Sending Json output via CURL

vickymanoignis — Wed, 26 May 2021 05:46:06 GMT

@kamlesh_vaghela Thanks for the reply,

curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d '{"sourcetype": "some-fields", "fields":"$asset"}'

in this $asset considered as an string, and the result:

Re: Sending Json output via CURL

kamlesh_vaghela — Wed, 26 May 2021 05:58:49 GMT

@vickymanoignis

curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d '{"sourcetype": "some-fields", "fields":"'$asset'"}'

Can you please try this?

Re: Sending Json output via CURL

vickymanoignis — Wed, 26 May 2021 06:17:11 GMT

Throwing the same error like first.

Result:

{"text":"Success","code":0}curl: (6) Could not resolve host: "Reservations"

curl: (3) [globbing] bad range specification in column 2

curl: (3) [globbing] unmatched brace in column 1

curl: (6) Could not resolve host: "Groups"

curl: (6) Could not resolve host: [],

curl: (6) Could not resolve host: "Instances"

curl: (3) [globbing] bad range specification in column 2

curl: (3) [globbing] unmatched brace in column 1

curl: (6) Could not resolve host: "AmiLaunchIndex

Re: Sending Json output via CURL

kamlesh_vaghela — Wed, 26 May 2021 08:55:06 GMT

@vickymanoignis

Can you please try this?

data="{\"sourcetype\": \"some-fields\", \"fields\": \"$asset\"}" curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d "$data"