All Apps and Add-ons

TA-Webtools - Why am I getting the error CURL invalid json in request?

glouka_tp
Loves-to-Learn Everything

Hello,

I'm trying to run the following:

 

| makeresults count=1

| eval data = "{\"something\":\"something\",\"something\":\"something\",\"something\":\"something\"}"

| eval header = "{\"header-api-key\":\"something\"}"

| curl  method=post  uri="https://api.something/v2" headerfield=header  data=data debug=t verifyssl=false

| table  *

 

and I'm getting

"{"status": "error", "result": "Invalid json format in the request".

Also I tried to add

"{\"content-type\":\"application/json\"}" like :

 

| eval header = "{"{\"content-type\":\"application/json\"}",\"header-api-key\":\"something\"}"

 

but I get the some error. Note that I have the latest version of TA-webtools

Anyone has any suggestions? 

Thank in advance 

Labels (1)
Tags (4)
0 Karma

gjanders
SplunkTrust
SplunkTrust

Try datafield=data

 

| curl  method=post  uri="https://api.something/v2" headerfield=header  datafield=data debug=t verifyssl=false

 

0 Karma

glouka_tp
Loves-to-Learn Everything

Same error as before

0 Karma

gjanders
SplunkTrust
SplunkTrust

I've used nearly identical settings and it works.

 

If you hit same endpoint using the actual curl CLI tool do you see the same issue?

0 Karma

glouka_tp
Loves-to-Learn Everything

Thank for your reply gjanders.

I don't have any error with the actual curl. The response is in a json format.

Find below the actual curl:

curl -X POST -d @option.txt -k -H "header-api-key:<API KEY>" "https://api.something/v2"

 

option.txt file:

{

"something": "something",

"something": "something",

"something": "something"

}

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...