Getting Data In

Why am I having this issue with HEC guid?


I have ack enabled for a HEC input. I can successfully send data into splunk with guid #1. With the same curl but a different guid #2 the data is not in splunk but the response is Success and the ack Id request also returns true.

I looked in splunkd.log and I see this:

08-09-2022 17:10:04.755 -0700 ERROR JsonLineBreaker [49865490 parsing] - JSON StreamId:0 had parsing error:Unexpected character while looking for value: 'c' - data_source="http:dev", data_host="host:8088", data_sourcetype="sourcetype_name"

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...