Getting Data In

How can I send the content of the file to HTTP Event Collector in Splunk?

Dolis
Engager

I am using a script that gives me some data in json format, I want to send this data to splunk.
I can store the output of the script in a file but how can I send it to HTTP Event Collector?

Couple of things I tried but did not work:

------------------------------------------------
#!/bin/bash
FILE="output.json"
file1="cat answer.txt"
curl -k "https://prd-pxxx.splunkcloud.com:8088/services/collector"  -H "Authorization: Splunk XXXXX"  -d  '{"event": "$file1", "sourcetype": "manual"}'

-----------------------------------------------------------

curl -k "https://prd-pxxx.splunkcloud.com:8088/services/collector"  -H "Authorization: Splunk XXXXX"  -d  '{"event": "@output.json", "sourcetype": "manual"}'

-------------------------------------------------------------

curl -k "https://prd-p-w0gjo.splunkcloud.com:8088/services/collector"  -H "Authorization: Splunk d70b305e-01ef-490d-a6d8-b875d98e689b"   -d '{"sourcetype":"_json", "event": "@output.json", "source": "output.json}

-----------------------------------------------------------------

After trying this I understand that it literally sends everything specified in the event section. Is there a way I can send the content of the file or use a variable?

Thanks in advance!

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @Dolis 

You can do via script , read every line of file and send it as batch. more examples here, 

Use cURL to manage HTTP Event Collector tokens, events, and services - Splunk Documentation

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/HECExamples

----

An upvote would be appreciated and accept solution if it helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @Dolis 

You can do via script , read every line of file and send it as batch. more examples here, 

Use cURL to manage HTTP Event Collector tokens, events, and services - Splunk Documentation

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/HECExamples

----

An upvote would be appreciated and accept solution if it helps!

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...