Getting Data In

Not able to send csv data to splunk index via rest call - HEC

cbhattad1
New Member

curl -k "http://host:8088/services/collector/?sourcetype=csv& index=csv_data" \
-H "Authorization: Splunk < token key >" \
-d 'a,b,c

1,3,4

2,4,5
'

The above call returns success. but when I see the index data in Splunk search, I see all the fields in one column _raw along with other fields like host, source etc

_raw
a,b,c
1,3,4
2,4,5

I want to see the fields to be separated by comma. I want the below output . with a, b, c as field names

a  b  c
1  3  4
2  4  5
0 Karma

tiagofbmm
Influencer

starcher
Influencer

@tiagofbmm is right. HEC is not a file submission method. it. is an event submission method. Reading and sending the csv is on your code.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...