Getting Data In

Why is c# logging to HTTP Event Collector not working?

rvencu
Path Finder

I am trying to send events from my Windows server .NET app to Splunk index via HTTP Event Collector.

I was able to setup the collector and verified it from localhost and from another Linux machine by using simple curl commands as documented, so the collector is listening and is adding data to the index as supposed to do.

However when trying to send events from .NET c# app I face the impossible. I tried all sample code Splunk made available, from simple to complex with no good results.

Now, since the curl is working I am trying to do the very basic curl emulation in c# via a webrequest object. I am stuck now with the authentication. I tried various authentication headers but it seems none wants to work. The ones with encryption generates 400 Bad Request. The simple one from the code sample below generates 401 Unauthorized.

I need some help to solve this issue.

WebRequest request = WebRequest.Create("https://splunkserver:8088/services/collector/event");

request.Method = "POST";

request.Headers.Add("Authorization", "splunk 1EDC2170-023A-468A-9ADD-8A879755DC74");

ASCIIEncoding encoding = new ASCIIEncoding();
byte[] byte1 = encoding.GetBytes("this is a raw event line");
request.ContentLength = byte1.Length;
Stream newStream = request.GetRequestStream();
newStream.Write(byte1, 0, byte1.Length);

WebResponse response = request.GetResponse();

Stream dataStream = response.GetResponseStream();`

StreamReader reader = new StreamReader(dataStream);`

string serverResponse = reader.ReadToEnd();
1 Solution

rvencu
Path Finder

Solved. The authorization header REQUIRED the username to be Splunk not splunk. So the C# emulation of the curl command is working well now.

The PHP version is not yet but I do not need it anymore.

View solution in original post

0 Karma

rvencu
Path Finder

Solved. The authorization header REQUIRED the username to be Splunk not splunk. So the C# emulation of the curl command is working well now.

The PHP version is not yet but I do not need it anymore.

View solution in original post

0 Karma

rvencu
Path Finder

One more issue. From the windows machine where I installed curl for basic testing, the same curl command that gets logged from linux machine is throwing this error

{"text":"Invalid data format","code":6,"invalid-event-number":0}

0 Karma

rvencu
Path Finder

OK, that one required getting rid of single quotes like this:
-d "{\"event\": \"hello world\"}"
It works fine now. Still from C# there no progress whatsoever...

0 Karma

rvencu
Path Finder

And this code in PHP (ran from a linux machine) will produce the same error

$data = array("event"=>"php test");
$data_string = json_encode($data);

$ch = curl_init();
$headr = array();
$headr[] = 'Content-Type:application/json';
$headr[] = 'Authorization: Splunk 1EDC2170-023A-468A-9ADD-8A879755DC74';
$headr[] = 'Content-Lenght: ' . strlen(data_string);

curl_setopt($ch, CURLOPT_HTTPHEADER,$headr);
curl_setopt($ch, CURLOPT_URL,"https://splunkserver:8088/services/collector/event");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, data_string);

// receive server response ...
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$server_output = curl_exec ($ch);

curl_close ($ch);

echo $server_output;
echo "<div>".$data_string."</div>";`

will generate
{"text":"Invalid data format","code":6,"invalid-event-number":0}
{"event":"php test"}

Baffled what is wrong with the data format...

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!