Getting Data In

how to pass "fields" parameter in services/collector rest api?

mmah123
New Member

Hello Experts,
I am working on HEC rest api's /services/collector. Passing fields as given in the examples but getting "no data" error. Is there any configuration i need to take care?

Eg: {"event": "something happened", "fields": {"severity": "INFO", "category": ["foo", "bar"]}

Error:
{
"text": "No data",
"code": 5
}

Thanks in advance!
Mamatha M

Tags (2)
0 Karma

jagadeeshm
Contributor

HEC will not allow you to pass arbitrary metadata fields. "fields" is not a required field in the HEC protocol. Only the following are supported at the movement -

{
    "time": 1426279439, 
    "host": "localhost",
    "source": "datasource",
    "sourcetype": "txt",
    "index": "main",
    "event": { "hello": "world" }
}
0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 3)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...