I am using HTTP Event Collector to post data from my application to splunk and has issues with it.

deepu1107 — Tue, 05 Jun 2018 02:14:12 GMT

I am using HTTP Event Collector to post data from my application to splunk and was able to successfully post the simple json string but in case of complex json string I am getting an error saying 400 bad request. I have given my data in the description section
I am able to post the below string successfully
{
"event: Abcdef, Y10EE888, EEE"
}

but I am getting the error with the below Json String
{
"Student":{
"FirstName":"Abc",
"LastName":"Def",
"FlashID":"12345",
"FlashEmailID":"abc@def.com",
"StudentDegreeofEnrollment":"MS",
"StudentCourses":[
{
"CourseID":"101",
"CourseName":"SEM"
}
],
"StudentMajor":"EE"
}
}

I am passing Authorization value and content type (application/json) in HTTP request headers. I am not able to figure out why the request was failing with 400 Bad request even the Json string is properly formatted. Any help on this is appreciated.

Thanks

Re: I am using HTTP Event Collector to post data from my application to splunk and has issues with it.

FrankVl — Tue, 05 Jun 2018 07:11:16 GMT

That's because splunk expects the outer layer of JSON to look like this:

{
 ...
 "event": "..."
 ...
}

So you need to nest your actual JSON string inside the event field. See also: http://docs.splunk.com/Documentation/Splunk/latest/Data/FormatEventsforHTTPEventCollector#Examples

topic Re: I am using HTTP Event Collector to post data from my application to splunk and has issues with it. in Getting Data In

I am using HTTP Event Collector to post data from my application to splunk and has issues with it.

Re: I am using HTTP Event Collector to post data from my application to splunk and has issues with it.