I am using HTTP Event Collector to post data from my application to splunk and was able to successfully post the simple json string but in case of complex json string I am getting an error saying 400 bad request. I have given my data in the description section
I am able to post the below string successfully
{
"event: Abcdef, Y10EE888, EEE"
}
but I am getting the error with the below Json String
{
"Student":{
"FirstName":"Abc",
"LastName":"Def",
"FlashID":"12345",
"FlashEmailID":"abc@def.com",
"StudentDegreeofEnrollment":"MS",
"StudentCourses":[
{
"CourseID":"101",
"CourseName":"SEM"
}
],
"StudentMajor":"EE"
}
}
I am passing Authorization value and content type (application/json) in HTTP request headers. I am not able to figure out why the request was failing with 400 Bad request even the Json string is properly formatted. Any help on this is appreciated.
Thanks
That's because splunk expects the outer layer of JSON to look like this:
{
...
"event": "..."
...
}
So you need to nest your actual JSON string inside the event field. See also: http://docs.splunk.com/Documentation/Splunk/latest/Data/FormatEventsforHTTPEventCollector#Examples