Why is c# logging to HTTP Event Collector not working?

[rvencu]

I am trying to send events from my Windows server .NET app to Splunk index via HTTP Event Collector.

I was able to setup the collector and verified it from localhost and from another Linux machine by using simple curl commands as documented, so the collector is listening and is adding data to the index as supposed to do.

However when trying to send events from .NET c# app I face the impossible. I tried all sample code Splunk made available, from simple to complex with no good results.

Now, since the curl is working I am trying to do the very basic curl emulation in c# via a webrequest object. I am stuck now with the authentication. I tried various authentication headers but it seems none wants to work. The ones with encryption generates 400 Bad Request. The simple one from the code sample below generates 401 Unauthorized.

I need some help to solve this issue.

WebRequest request = WebRequest.Create("https://splunkserver:8088/services/collector/event");

request.Method = "POST";

request.Headers.Add("Authorization", "splunk 1EDC2170-023A-468A-9ADD-8A879755DC74");

ASCIIEncoding encoding = new ASCIIEncoding();
byte[] byte1 = encoding.GetBytes("this is a raw event line");
request.ContentLength = byte1.Length;
Stream newStream = request.GetRequestStream();
newStream.Write(byte1, 0, byte1.Length);

WebResponse response = request.GetResponse();

Stream dataStream = response.GetResponseStream();`

StreamReader reader = new StreamReader(dataStream);`

string serverResponse = reader.ReadToEnd();

[rvencu · Accepted solution]

Solved. The authorization header REQUIRED the username to be Splunk not splunk. So the C# emulation of the curl command is working well now.

The PHP version is not yet but I do not need it anymore.

[rvencu]

One more issue. From the windows machine where I installed curl for basic testing, the same curl command that gets logged from linux machine is throwing this error

{"text":"Invalid data format","code":6,"invalid-event-number":0}

[rvencu]

OK, that one required getting rid of single quotes like this:
-d "{\"event\": \"hello world\"}"
It works fine now. Still from C# there no progress whatsoever...

[rvencu]

And this code in PHP (ran from a linux machine) will produce the same error

$data = array("event"=>"php test");
$data_string = json_encode($data);

$ch = curl_init();
$headr = array();
$headr[] = 'Content-Type:application/json';
$headr[] = 'Authorization: Splunk 1EDC2170-023A-468A-9ADD-8A879755DC74';
$headr[] = 'Content-Lenght: ' . strlen(data_string);

curl_setopt($ch, CURLOPT_HTTPHEADER,$headr);
curl_setopt($ch, CURLOPT_URL,"https://splunkserver:8088/services/collector/event");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, data_string);

// receive server response ...
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$server_output = curl_exec ($ch);

curl_close ($ch);

echo $server_output;
echo "<div>".$data_string."</div>";`

will generate
{"text":"Invalid data format","code":6,"invalid-event-number":0}
{"event":"php test"}

Baffled what is wrong with the data format...