Splunk HEC: Python post requests fails with 401 Unauthorized client error while cURL requests are fine

[spervez]

I have created a python script to post json data to Splunk:

splunk_ep = 'https://xxx:8088/services/collector/event'
SPLUNK_TOKEN = os.getenv('SPLUNK_TOKEN')
auth_header = {'Authorization': SPLUNK_TOKEN, 'Content-Type': 'application/json'}

def SendToSplunk(data):
        response = requests.post(splunk_ep, json=data, headers=auth_header, verify = False)
        print(response)

It returns following error:
401 Client Error: Unauthorized for url: https://xxx:8088/services/collector/event

However, If use cURL with above params, it works fine. Please advise.
Thanks

[starcher]

You could also use a pre-made HEC class.
https://github.com/georgestarcher/Splunk-Class-httpevent

[renjith_nair]

@spervez,

In the authorization header, you need to add the Splunk keyword "Authorization: Splunk <hec_token>" . If your environment variable does not have this, try adding the keyword.

[spervez]

Hi Renjith,
Thanks for coming back.

I have resolved the issue and it was a stupid error I was making in using keyword SPLUNK instead of Splunk.

Regards

[renjith_nair]

@spervez, glad its working. If you think the above answer helped you to resolve the issue, accept/upvote.
Also try the class mentioned by George below. That will definitely help you to get going.