topic Re: HTTP Event Collector 400 Bad Request in Getting Data In

HTTP Event Collector 400 Bad Request

KP2018 — Tue, 29 Sep 2020 17:49:25 GMT

I am sending a request to Splunk using .NET code which returns a response of (400) Bad Request.
The bytes are seen as received by Splunk in the log file http_event_collector_metrics however there seems to be some parsing error flag getting set "num_of_parser_errors":1. The index search does not show any data being received.

Similar request using the same token is working with Python. What could be the problem in below .NET code ?

Code is as below:

class Program
{
    static void Main(string[] args)
    {
        WebRequest request = WebRequest.Create("http://localhost:8088/services/collector/event");
        request.ContentType = "application/json";
        request.Method = "POST";
        request.Headers.Add("Authorization", "Splunk 6d8a53cd-eb65-4a1d-abb9-6dc8ad01e616");

        string strjson = "{\"QUEUE\":\"STARTED\"," +
              "\"STATUS\":\"SUCCESS\"}";

        try
        {

            using (var streamWriter = new StreamWriter(request.GetRequestStream()))
            {

                streamWriter.Write(strjson);
                streamWriter.Flush();
                streamWriter.Close();
            }

            var httpResponse = (HttpWebResponse)request.GetResponse();
            using (var streamReader = new StreamReader(httpResponse.GetResponseStream()))
            {
                var result = streamReader.ReadToEnd();
                System.Diagnostics.Debug.WriteLine("Data sent to splunk...." );
                System.Diagnostics.Debug.WriteLine(result);
            }

        }
        catch (Exception e)
        {
            System.Diagnostics.Debug.WriteLine(e);
        }

    }
}

Note the

Re: HTTP Event Collector 400 Bad Request

starcher — Tue, 23 Jan 2018 20:21:48 GMT

You are missing a lot of the expected fields for a JSON HEC event. Such as index, sourcetype, host, source etc as metadata then your event data should be in a field called event. I don't know .net but here is example in python. It should give you idea on building your JSON to post.

https://github.com/georgestarcher/Splunk-Class-httpevent

Re: HTTP Event Collector 400 Bad Request

KP2018 — Mon, 29 Jan 2018 07:46:39 GMT

With Python it is already working for me as mentioned in my original query. Need to know how to work with .NET

Re: HTTP Event Collector 400 Bad Request

KP2018 — Tue, 30 Jan 2018 07:23:42 GMT

Ok have solved it the problem with DotNet code was with the JSON string. Changing it to below solved the problem.

string strjson = "{ \"event\": \"{QUEUE:STARTED,STATUS:SUCCESS}\"}";