Getting Data In
Highlighted

How to send json data via HEC

New Member

I am using a Python script to send data to Splunk via HEC. There's no problem when curling a simple "Hello World".
However, I would like to curl search results (json format) obtained via a Python script. Here's how the snippet of the Python script to get the results in json format.

alt text

The results look like this:

{'id': {'$oid': '5ec4f96e67ac75656af5ea5b'}, 'createdat': '2020-05-10T09:33:33.490855', 'appidcaller': 'fg67k78k-7f44-5c90-a1b6-42gf5jjjj00a', 'input': {'targethost': 'portal-azure.cloud.io',
'target_port': 443}, 'output': {'result': False, 'info': 'Application has failed security checks. Drill down the results [array] to find information.', 'results': [{'category': 'hosting', 'result': False, 'title': 'Insecure use of shared hosting subdomain', 'description': "The application uses shared hosting parent domain. Recommended to use (e.g.: *.abc.com, *.abc.cloud, etc).", 'cwe': 348, 'checks': []}]}}

Question is: how do I curl the results (server_info) using HEC? I'm getting an error 400. I'm guessing the problem lies with the 'data' variable where it may not be defined properly. Also, I've tried the endpoints; services/collector and services/collector/event but none worked. When using services/collector/raw endpoint, I did get a response code 200 which indicated successful but jargon data was displayed in Splunk. Below is the post script used.

splunk_headers = {'Authorization': 'Splunk f5t34545-xxxxxc-xxxx-xxxx-xxxx-xxxxxxxx'}
data = {"sourcetype": "server","event": server_info}
response = requests.post('https://server03.na.abc.com:8088/services/collector/event', headers=splunk_headers, data=data, verify=False)

Thank you.

0 Karma
Highlighted

Re: How to send json data via HEC

Communicator

Try setting Content-Type 'application/json' in the headers. This is an example I'm doing using Python requests module.

requests.post("https://hec-server:8088/services/collector", headers={'Authorization': 'Splunk xxxxxxxxxxxxxxxx','Content-Type': 'application/json'}, data=json.dumps({'event': dictVar}), verify="False")

0 Karma
Highlighted

Re: How to send json data via HEC

New Member

Thanks. I tried using your script but it didnt work. The error message was "Could not find a suitable TLS CA certificate bundle, invalid path: False"

Is dictVar the variable that you have defined for the json results? If so, I replaced it with mine which is server_info.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.