Getting Data In

HEC not giving JSON output when using python

rohitmaheshwari
Explorer

I am fairly new to python and I am trying to use a python script to get the health of my HEC in JSON format.

When I am using a curl command like below:
curl -k -s -u 'username:password' -X GET https:myServername:8088/services/collector/health
I get the below response:
{"text":"HEC is healthy","code":17}

But when I am using the same command in python to get json event such as above its giving me an error saying the "NO json objects could be decoded"
and when I hash out the json.loads() variable from the below script, the output says in an html format "The request your client sent was too large".

This might be sending me an html response no matter what. Can you please suggest how to get a JSON response from 8088 port for the /services/collector/health endpoint.

python script below:

!/usr/bin/python

import json
import os
import re
import sys
import urllib
import httplib2
import credentials
import requests

username = credentials.username
baseurl = credentials.baseurl
password = credentials.password
hecBaseUrl = 'https://myServer:8088'
myhttp = httplib2.Http(disable_ssl_certificate_validation=True)

try:

cmdurl = '/services/auth/login'
serverResponse = myhttp.request(baseurl + cmdurl, 'POST', headers={}, body=urllib.urlencode({'username':username, 'password':password,'output_mode':'json'}))[1]

print serverResponse

parsed_json = json.loads(serverResponse)
sessionKey = parsed_json['sessionKey']
print "sessionKey is %s" % sessionKey
hecUrl = '/services/collector/health'
totalUrl = (hecBaseUrl + hecUrl)
print totalUrl
hecServerResponse = myhttp.request(hecBaseUrl + hecUrl, 'GET', headers={}, body=urllib.urlencode({'output_mode':'json'}))[1]
parsed_json_hec = json.loads(hecServerResponse)
print parsed_json_hec
print hecServerResponse
except Exception, err:
sys.stderr.write('Error: %s\n' %str(err))

0 Karma

arjunpkishore5
Motivator

Your code is unnecessarily complex

import requests
from requests.auth import HTTPBasicAuth
import json

username = 'username'
password = 'password'
hecBaseUrl = 'https://myServer:8088'

response = json.loads(requests.get('{}/services/collector/health'.format(hecBaseUrl), auth=HTTPBasicAuth(username, password), verify=False).text)

print(json.dumps(response, indent=4))

rohitmaheshwari
Explorer

Thankyou Arjun,

This works.
I had to add a zero in the curly braces.
response = json.loads(requests.get('{0}/services/collector/health'.format(hecBaseUrl), auth=HTTPBasicAuth(username, password), verify=False).text)

If possible can you please explain this request.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Index This | What has goals but no motivation?

June 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...