Getting Data In

Add-On calling HEC

Path Finder


I am trying to collect data via a REST API and store it as a metric using the add-on builder and python. Unfortunately you cannot seem to store metric data in Splunk using the default commands available to you and it seems as though you have to go via the HEC which is fine as I can do that... However when it comes to calling the HEC directly, I get a 403 error which seems to indicate its an authorization issue.

I have tested the message I am sending through in curl and it's ingesting fine which makes me think there may be an issue with the SSL certs.

Python Code

hec_header={'Authorization': 'Splunk 2ec63ec6-fa0f-499a-8ecf-05b6c0eb4574'}


ERROR403 Client Error: Forbidden for url: http://localhost:8088/services/collector

Any assistance would be much appreciated


0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...