HTTP Event Collector 400 Bad Request

[KP2018]

I am sending a request to Splunk using .NET code which returns a response of (400) Bad Request.
The bytes are seen as received by Splunk in the log file http_event_collector_metrics however there seems to be some parsing error flag getting set "num_of_parser_errors":1. The index search does not show any data being received.

Similar request using the same token is working with Python. What could be the problem in below .NET code ?

Code is as below:

class Program
{
    static void Main(string[] args)
    {
        WebRequest request = WebRequest.Create("http://localhost:8088/services/collector/event");
        request.ContentType = "application/json";
        request.Method = "POST";
        request.Headers.Add("Authorization", "Splunk 6d8a53cd-eb65-4a1d-abb9-6dc8ad01e616");

        string strjson = "{\"QUEUE\":\"STARTED\"," +
              "\"STATUS\":\"SUCCESS\"}";

        try
        {

            using (var streamWriter = new StreamWriter(request.GetRequestStream()))
            {

                streamWriter.Write(strjson);
                streamWriter.Flush();
                streamWriter.Close();
            }

            var httpResponse = (HttpWebResponse)request.GetResponse();
            using (var streamReader = new StreamReader(httpResponse.GetResponseStream()))
            {
                var result = streamReader.ReadToEnd();
                System.Diagnostics.Debug.WriteLine("Data sent to splunk...." );
                System.Diagnostics.Debug.WriteLine(result);
            }

        }
        catch (Exception e)
        {
            System.Diagnostics.Debug.WriteLine(e);
        }

    }
}

Note the

[KP2018]

Ok have solved it the problem with DotNet code was with the JSON string. Changing it to below solved the problem.

string strjson = "{ \"event\": \"{QUEUE:STARTED,STATUS:SUCCESS}\"}";

[KP2018]

With Python it is already working for me as mentioned in my original query. Need to know how to work with .NET

[starcher]

You are missing a lot of the expected fields for a JSON HEC event. Such as index, sourcetype, host, source etc as metadata then your event data should be in a field called event. I don't know .net but here is example in python. It should give you idea on building your JSON to post.

https://github.com/georgestarcher/Splunk-Class-httpevent