Getting Data In

How to post to Http Event Collector with PHP?

daniel333
Builder

All,

Anyone ever post to HEC using PHP? Got a working example? Or see where I am going wrong?

<?php
        $ch = curl_init("https://10.x.x.x:8088/services/collector/event");
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_USERPWD, "x:MYTOKEN");
        curl_setopt($ch, CURLOPT_POSTFIELDS, "number=10");
        $output = curl_exec($ch);
        curl_close($ch);
        echo $output;
?>
0 Karma
1 Solution

daniel333
Builder

Got it! Trick was the formatting of the $data variable.

// Send Data to HEC with PHP

<?php
        $data = "{\"event\":\"testing\",\"sourcetype\": \"st\"}";
        $ch = curl_init("https://10.x.x.x:8088/services/collector/event");
        curl_setopt($ch, CURLOPT_VERBOSE, true);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_USERPWD, "x:cbmytoen");
        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
        $output = curl_exec($ch);
        curl_close($ch);
        echo $output;
?>

View solution in original post

daniel333
Builder

Got it! Trick was the formatting of the $data variable.

// Send Data to HEC with PHP

<?php
        $data = "{\"event\":\"testing\",\"sourcetype\": \"st\"}";
        $ch = curl_init("https://10.x.x.x:8088/services/collector/event");
        curl_setopt($ch, CURLOPT_VERBOSE, true);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_USERPWD, "x:cbmytoen");
        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
        $output = curl_exec($ch);
        curl_close($ch);
        echo $output;
?>
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...