topic Re: Server returned HTTP response code: 400 for URL: http://localhost:8088/services/collector in Installation

Server returned HTTP response code: 400 for URL: http://localhost:8088/services/collector

P01YOGESHC — Wed, 16 Sep 2020 15:49:03 GMT

Hi I am getting the below error while sending the login event from my website to Splunk.

Server returned HTTP response code: 400 for URL: http://localhost:8088/services/collector.

I have check vial curl command

curl -k "http://localhost:8088/services/collector" \ -H "Authorization: Splunk c14********************44f5" \ -d '{"event": "Hello, world!", "sourcetype": "manual"}'{"text":"Data channel is missing","code":10}curl: (6) Could not resolve host: \
curl: (6) Could not resolve host: \
curl: (6) Could not resolve host: Hello, world!,
curl: (6) Could not resolve host: sourcetype
curl: (3) [globbing] unmatched close brace/bracket in column 7

Please let me know what is missing I have also enabled HTTP Event Collector from global settings. I am using latest version of splunk Version:8.0.6

Re: Server returned HTTP response code: 400 for URL: http://localhost:8088/services/collector

alemarzu — Wed, 16 Sep 2020 21:46:35 GMT

Hi @P01YOGESHC

Give this a try, and make sure your other server can resolve your splunk instance DNS, if not use the IP. Also, check SSL on url (http or https) and replace HEC token.

curl -k "http://DNS_OR_IP:8088/services/collector" -H "Authorization: Splunk C*****4-3**9-4**5-A**C-3**********7" -d '{"event": "Hello, world!", "sourcetype": "manual"}'

Re: Server returned HTTP response code: 400 for URL: http://localhost:8088/services/collector

ivanreis — Wed, 16 Sep 2020 23:48:18 GMT

Hi @P01YOGESHC , please give a try on the sample below.

I ran a test in my sandbox to index raw events and I have to add the channel plus token to get data indexed

In order to get the channel, please run this query on splunk srv.

index="_internal" sourcetype=splunkd host=<server_name> | search guid!=" " | stats latest(host) latest(guid)

In my test I used the ip address, but you can try the FQDN as well, then you can add the guid to the channel and the token after Authorization:Splunk

I also added the index and sourcetype to the comment

This sample works properly for raw event.

The server name should be the one where the HEC is setup to receive the data
curl -k "https://XXX.X.XXX.XXX:8088/services/collector/raw?channel=23XXXXX-XXX-XXXX-XXXX-XXXXXXXXXX&sourcetype=httpevent&index=main" -H "Authorization: Splunk 46XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" -d '1, 2, 3... Hello, world!'

for further information, please check other samples at https://docs.splunk.com/Documentation/Splunk/8.0.6/Data/HECExamples

If this helps, please upvote. thanks