Who can tell me why the API POST for JSON doc times out -

[himynamesdave]

This DOES NOT work:

curl -k -u admin:changeme "https://0.0.0.0:8089/services/receivers/simple?source=mysource&index=myindex" -d {"somefield":"foobar”}

This DOES work:

curl -k -u admin:changeme "https://0.0.0.0:8089/services/receivers/simple?source=mysource&index=myindex" -d somefield=foobar

Looking at the docs (http://dev.splunk.com/view/SP-CAAADQT), I think this is hinting at why the first request is broken "The -d/--post-data arguments for curl/wget need to be url-encoded, should they have characters needing escaping."

Can someone tell me how a JSON data should be formatted to be submitted like this? Thanks!

[martin_mueller · Accepted solution]

Sounds like a curl/shell issue to me. curl -d "string" means you want something like this:

curl ... -d "foo bar"

As a result, I'd guess passing JSON might look like this (untested):

curl ... -d "{\"somefield\":\"foobar\"}"