What are the Unsupported Characters for HEC

[teixeie]

Hi Splunk,

It seems that sending log messages to Splunk HEC endpoints containing "\n", or "\r" or "\t" causes the Hec endpoint to respond... "{"text":"Invalid data format","code":6,"invalid-event-number":0}". Anyone knows where one can find  the list of characters that are not permitted ?

Thank you,

Eduardo

[ivanreis · Accepted solution]

Hi @teixeie , I was doing some research about it and I did not find any document or post that makes reference in how to scape those characters.
I found a document where they mentioned about this error "{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}  and how it can be fixed. The author is using the json format, and maybe it can be applied to your case, it is worth to try.

https://medium.com/adarma-tech-blog/splunk-http-event-collectors-explained-2c22e87ab8d2

Top Tips:

Double-quotes in the JSON Collector
When sending events that contain double-quotes (“”) or nested JSON structures, ie. a stream of text with JSON within “event” key, escape the double-quotes:
before: {“event”:”{“field1”:”value1"}”}
after: {“event”:”{\“field1\”:\”value1\"}”}
OR
before: {“event”:”[15/11/2019 11:00:00]“field1” ”field2"”}
after: {“event”:”[15/11/2019 11:00:00] \“field1\” \”field2\"”}
Otherwise Splunk will reply with:
{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}

If this help, please upvote. 

[teixeie]

Thank you Ivanreis!

Escaping those characters indeed resolved the issue. I will add escaping for double quotes as well.