After setting up the HTTP Event Collector on a heavy forwarder, why am I getting error "token is required" when submitting events?

[a212830]

Hi,

I was able to get the HEC up and running on a HFW, but now when I submit an event, I get "token is required", even though I'm passing a token.

curl -k https://myserver.com:8088/services/collector/event -H "Authorization Splunk: 7E36213E-03E1-4246-93B9-81931D303A58" -d '{"event": "hello world"}'

Anyone run into this?

[a212830 · Accepted solution]

Never mind: got it:

curl -k https://myserver.com:8088/services/collector/event -H 'Authorization: Splunk 7E36213E-03E1-4246-93B9-81931D303A58' -d '{"event": "hello world2"}'

[sloshburch]

Converted your post to answer so you can mark it as accepted.

For other folks who run into the same thing, was the issue just that the header is Authorization not Authorization Splunk and therefore once you moved the : after Authorization it all worked?