Getting Data In

Sending Json output via CURL

vickymanoignis
Loves-to-Learn

I m just trying to feed the AWS instance data to Splunk, the output for "aws ec2 describe-instances" is in json format and i m placing the result to a variable. now i m trying to call the variable in curl command 

asset = aws ec2 describe-instances
echo $asset
curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d {"sourcetype": "some-fields", "fields":'$asset'}"

and output seems like 

curl: (6) Could not resolve host: "disabled"

curl: (3) [globbing] unmatched close brace/bracket in column 1

could some one give a better solution?

Labels (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vickymanoignis 

Have you tried this?

curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d '{"sourcetype": "some-fields", "fields":"$asset"}'

 

0 Karma

vickymanoignis
Loves-to-Learn

@kamlesh_vaghela Thanks for the reply, 

curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d '{"sourcetype": "some-fields", "fields":"$asset"}'

in this $asset considered as an string, and the result:

Screenshot 2021-05-26 at 11.12.48 AM.png

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vickymanoignis 

curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d '{"sourcetype": "some-fields", "fields":"'$asset'"}'

Can you please try this?
 

0 Karma

vickymanoignis
Loves-to-Learn

Throwing the same error like first.

Result:

{"text":"Success","code":0}curl: (6) Could not resolve host: "Reservations"

curl: (3) [globbing] bad range specification in column 2

curl: (3) [globbing] unmatched brace in column 1

curl: (6) Could not resolve host: "Groups"

curl: (6) Could not resolve host: [],

curl: (6) Could not resolve host: "Instances"

curl: (3) [globbing] bad range specification in column 2

curl: (3) [globbing] unmatched brace in column 1

curl: (6) Could not resolve host: "AmiLaunchIndex

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vickymanoignis 

Can you please try this?

data="{\"sourcetype\": \"some-fields\", \"fields\": \"$asset\"}"

curl -k -H "Authorization: Splunk Auth_token" https://splunkcloud.com:8088/services/collector/raw -d "$data"
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...