Dashboards & Visualizations

After setting up the HTTP Event Collector on a heavy forwarder, why am I getting error "token is required" when submitting events?

a212830
Champion

Hi,

I was able to get the HEC up and running on a HFW, but now when I submit an event, I get "token is required", even though I'm passing a token.

curl -k https://myserver.com:8088/services/collector/event -H "Authorization Splunk: 7E36213E-03E1-4246-93B9-81931D303A58" -d '{"event": "hello world"}'

Anyone run into this?

1 Solution

a212830
Champion

Never mind: got it:

curl -k https://myserver.com:8088/services/collector/event -H 'Authorization: Splunk 7E36213E-03E1-4246-93B9-81931D303A58' -d '{"event": "hello world2"}'

View solution in original post

a212830
Champion

Never mind: got it:

curl -k https://myserver.com:8088/services/collector/event -H 'Authorization: Splunk 7E36213E-03E1-4246-93B9-81931D303A58' -d '{"event": "hello world2"}'

sloshburch
Splunk Employee
Splunk Employee

Converted your post to answer so you can mark it as accepted.

For other folks who run into the same thing, was the issue just that the header is Authorization not Authorization Splunk and therefore once you moved the : after Authorization it all worked?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...