Getting Data In

how to pass "fields" parameter in services/collector rest api?

mmah123
New Member

Hello Experts,
I am working on HEC rest api's /services/collector. Passing fields as given in the examples but getting "no data" error. Is there any configuration i need to take care?

Eg: {"event": "something happened", "fields": {"severity": "INFO", "category": ["foo", "bar"]}

Error:
{
"text": "No data",
"code": 5
}

Thanks in advance!
Mamatha M

Tags (2)
0 Karma

jagadeeshm
Contributor

HEC will not allow you to pass arbitrary metadata fields. "fields" is not a required field in the HEC protocol. Only the following are supported at the movement -

{
    "time": 1426279439, 
    "host": "localhost",
    "source": "datasource",
    "sourcetype": "txt",
    "index": "main",
    "event": { "hello": "world" }
}
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...