Getting Data In

how to pass "fields" parameter in services/collector rest api?

mmah123
New Member

Hello Experts,
I am working on HEC rest api's /services/collector. Passing fields as given in the examples but getting "no data" error. Is there any configuration i need to take care?

Eg: {"event": "something happened", "fields": {"severity": "INFO", "category": ["foo", "bar"]}

Error:
{
"text": "No data",
"code": 5
}

Thanks in advance!
Mamatha M

Tags (2)
0 Karma

jagadeeshm
Contributor

HEC will not allow you to pass arbitrary metadata fields. "fields" is not a required field in the HEC protocol. Only the following are supported at the movement -

{
    "time": 1426279439, 
    "host": "localhost",
    "source": "datasource",
    "sourcetype": "txt",
    "index": "main",
    "event": { "hello": "world" }
}
0 Karma
Get Updates on the Splunk Community!

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...

New Splunk Innovations Enhance Performance and Accelerate Troubleshooting

Splunk is excited to announce new releases that empower ITOps and engineering teams to stay ahead in ever ...