Getting Data In

What are the Unsupported Characters for HEC

teixeie
Engager

Hi Splunk,

It seems that sending log messages to Splunk HEC endpoints containing "\n", or "\r" or "\t" causes the Hec endpoint to respond... "{"text":"Invalid data format","code":6,"invalid-event-number":0}". Anyone knows where one can find  the list of characters that are not permitted ?

Thank you,

Eduardo

Labels (1)
0 Karma
1 Solution

ivanreis
Builder

Hi @teixeie , I was doing some research about it and I did not find any document or post that makes reference in how to scape those characters.
I found a document where they mentioned about this error "{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}  and how it can be fixed. The author is using the json format, and maybe it can be applied to your case, it is worth to try.

https://medium.com/adarma-tech-blog/splunk-http-event-collectors-explained-2c22e87ab8d2

Top Tips:

Double-quotes in the JSON Collector
When sending events that contain double-quotes (“”) or nested JSON structures, ie. a stream of text with JSON within “event” key, escape the double-quotes:
before: {“event”:”{“field1”:”value1"}”}
after: {“event”:”{\“field1\”:\”value1\"}”}
OR
before: {“event”:”[15/11/2019 11:00:00]“field1” ”field2"”}
after: {“event”:”[15/11/2019 11:00:00] \“field1\” \”field2\"”}
Otherwise Splunk will reply with:
{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}

If this help, please upvote. 

View solution in original post

ivanreis
Builder

Hi @teixeie , I was doing some research about it and I did not find any document or post that makes reference in how to scape those characters.
I found a document where they mentioned about this error "{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}  and how it can be fixed. The author is using the json format, and maybe it can be applied to your case, it is worth to try.

https://medium.com/adarma-tech-blog/splunk-http-event-collectors-explained-2c22e87ab8d2

Top Tips:

Double-quotes in the JSON Collector
When sending events that contain double-quotes (“”) or nested JSON structures, ie. a stream of text with JSON within “event” key, escape the double-quotes:
before: {“event”:”{“field1”:”value1"}”}
after: {“event”:”{\“field1\”:\”value1\"}”}
OR
before: {“event”:”[15/11/2019 11:00:00]“field1” ”field2"”}
after: {“event”:”[15/11/2019 11:00:00] \“field1\” \”field2\"”}
Otherwise Splunk will reply with:
{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}

If this help, please upvote. 

teixeie
Engager

Thank you Ivanreis!

Escaping those characters indeed resolved the issue. I will add escaping for double quotes as well.

 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...