Dashboards & Visualizations

After setting up the HTTP Event Collector on a heavy forwarder, why am I getting error "token is required" when submitting events?

Champion

Hi,

I was able to get the HEC up and running on a HFW, but now when I submit an event, I get "token is required", even though I'm passing a token.

curl -k https://myserver.com:8088/services/collector/event -H "Authorization Splunk: 7E36213E-03E1-4246-93B9-81931D303A58" -d '{"event": "hello world"}'

Anyone run into this?

1 Solution

Champion

Never mind: got it:

curl -k https://myserver.com:8088/services/collector/event -H 'Authorization: Splunk 7E36213E-03E1-4246-93B9-81931D303A58' -d '{"event": "hello world2"}'

View solution in original post

Champion

Never mind: got it:

curl -k https://myserver.com:8088/services/collector/event -H 'Authorization: Splunk 7E36213E-03E1-4246-93B9-81931D303A58' -d '{"event": "hello world2"}'

View solution in original post

Ultra Champion

Converted your post to answer so you can mark it as accepted.

For other folks who run into the same thing, was the issue just that the header is Authorization not Authorization Splunk and therefore once you moved the : after Authorization it all worked?