No HTTP response from Splunk when sending data

[bruceclarke]

All,

I'm trying to curl data to my Splunk indexer. The data is getting there, but I'm never receiving a response from Splunk that the data was received. This is causing issues, since I can't tell if the data was forwarded correctly. I receive a response from Splunk when I issue POSTs for searches, so this is NOT a connection issue.

Here is the curl command I'm issuing to a TCP enabled port. Like I say, the data is getting to Splunk, but I don't receive any response. Why might this be?

curl -k "http://MySplunkIndexer:515/services/receivers/simple" -d "Testkey=TestValue"

Thanks!

[acharlieh · Accepted solution]

A TCP input, is simply that. It is a lower level than HTTP. A tool like netcat is more appropriate for testing sending data over TCP.

However it looks like you're attempting to use the Splunk REST API to send data. This goes over the Splunk management port (By default your URL should be: https://yourSplunkIndexer:8089/services/receivers/simple ) It's been a while since I've played with the REST API to send data, but you may or may not need to authenticate for this endpoint as well.