topic Re: Why am I unable to pull any events, even though I receive a success message from cURL? in Splunk Search

Why am I unable to pull any events, even though I receive a success message from cURL?

mdeep — Tue, 15 Nov 2016 20:59:24 GMT

Hi ,

I am not able to pull events , even I got success message from cURL .Here is my command.

               curl -k -v http://localhost:8088/services/collector/event -H "Authorization: Splunk 5B7C169D-6415-4D56-97E9-2A836E48346E" -d '{"event":"Hello, World!","index":"tomcat_logs"}'
*   Trying xxx.xx.xx.xx...
* Connected to localhost (xxx.xx.xx.xx) port 8088 (#0)
> POST /services/collector/event HTTP/1.1
> Host: localhost:8088
> User-Agent: curl/7.43.0
> Accept: */*
> Authorization: Splunk 5B7C169D-6415-4D99-97E9-2A836E48346E
> Content-Length: 47
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 47 out of 47 bytes
< HTTP/1.1 200 OK
< Date: Tue, 15 Nov 2016 20:53:47 GMT
< Content-Type: application/json; charset=UTF-8
< X-Content-Type-Options: nosniff
< Content-Length: 27
< Vary: Authorization
< Connection: Keep-Alive
< X-Frame-Options: SAMEORIGIN
< Server: Splunkd
< 
* Connection #0 to host localhost left intact
{"text":"Success","code":0}

But when I search with index = *, it's not displaying any events.

Thanks,
Mani

Re: Why am I unable to pull any events, even though I receive a success message from cURL?

somesoni2 — Tue, 15 Nov 2016 21:58:18 GMT

When you setup your Event Collector input to generate authorization token, you would've specified index and sourcetype etc. Try searching with that to see if the data is available.

Re: Why am I unable to pull any events, even though I receive a success message from cURL?

mdeep — Tue, 15 Nov 2016 22:02:51 GMT

I tried with those index and source type but there is no result

Re: Why am I unable to pull any events, even though I receive a success message from cURL?

richgalloway — Wed, 16 Nov 2016 03:31:24 GMT

Are you searching All Time?

Re: Why am I unable to pull any events, even though I receive a success message from cURL?

mdeep — Wed, 16 Nov 2016 13:57:11 GMT

Yes , but I found the solution. During Event Collector set up I have mention sourcetype as _json, and later I have changed the sourcetype. Now able to pull the events .Thank you guys