Dashboards & Visualizations

After setting up the HTTP Event Collector on a heavy forwarder, why am I getting error "token is required" when submitting events?

a212830
Champion

Hi,

I was able to get the HEC up and running on a HFW, but now when I submit an event, I get "token is required", even though I'm passing a token.

curl -k https://myserver.com:8088/services/collector/event -H "Authorization Splunk: 7E36213E-03E1-4246-93B9-81931D303A58" -d '{"event": "hello world"}'

Anyone run into this?

1 Solution

a212830
Champion

Never mind: got it:

curl -k https://myserver.com:8088/services/collector/event -H 'Authorization: Splunk 7E36213E-03E1-4246-93B9-81931D303A58' -d '{"event": "hello world2"}'

View solution in original post

a212830
Champion

Never mind: got it:

curl -k https://myserver.com:8088/services/collector/event -H 'Authorization: Splunk 7E36213E-03E1-4246-93B9-81931D303A58' -d '{"event": "hello world2"}'

sloshburch
Splunk Employee
Splunk Employee

Converted your post to answer so you can mark it as accepted.

For other folks who run into the same thing, was the issue just that the header is Authorization not Authorization Splunk and therefore once you moved the : after Authorization it all worked?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...