Getting Data In

Splunk HEC: Python post requests fails with 401 Unauthorized client error while cURL requests are fine

spervez
New Member

I have created a python script to post json data to Splunk:

splunk_ep = 'https://xxx:8088/services/collector/event'
SPLUNK_TOKEN = os.getenv('SPLUNK_TOKEN')
auth_header = {'Authorization': SPLUNK_TOKEN, 'Content-Type': 'application/json'}

def SendToSplunk(data):
        response = requests.post(splunk_ep, json=data, headers=auth_header, verify = False)
        print(response)

It returns following error:
401 Client Error: Unauthorized for url: https://xxx:8088/services/collector/event

However, If use cURL with above params, it works fine. Please advise.
Thanks

0 Karma

starcher
Influencer

You could also use a pre-made HEC class.
https://github.com/georgestarcher/Splunk-Class-httpevent

renjith_nair
Legend

@spervez,

In the authorization header, you need to add the Splunk keyword "Authorization: Splunk <hec_token>" . If your environment variable does not have this, try adding the keyword.

---
What goes around comes around. If it helps, hit it with Karma 🙂

spervez
New Member

Hi Renjith,
Thanks for coming back.

I have resolved the issue and it was a stupid error I was making in using keyword SPLUNK instead of Splunk.

Regards

0 Karma

renjith_nair
Legend

@spervez, glad its working. If you think the above answer helped you to resolve the issue, accept/upvote.
Also try the class mentioned by George below. That will definitely help you to get going.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...