Getting Data In

some curl help

Splunk_citizen
Explorer

Hello Splunkers,

Can you please help me run this curl command in Unix when im getting error not seeing any data in splunk

curl -H “Authorization:b5eee0af-xxx-xxxxc-9972-9abb7b0f9338” -H “Content-Type: application/json” -XPOST “http://xx.1x1.x.210:8088” -d '
{
“d”: “xxx”,
“timestamp”: “Sat Dec 15 13:19:36 2019”,
“status”: “up”
}'

the below one working fine i need above one is also same to construct and work.

curl -k http://localhost:8088/services/collector/event -H "Authorization: Splunk acxxx04b6-e160-xxd2-a04b-xxbd931f142" -d "{\"time\": 1437522387,\"host\": \"localhost1\",\"source\":
\"testapp1\",\"sourcetype\":\"testapp1\",\"index\":\"test\",\"event\": {\"message\": \"Something happened1\",\"severity\": \"WARN\"}}

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The URLs don't match. You can try this command

curl -H “Authorization:b5eee0af-xxx-xxxxc-9972-9abb7b0f9338” -H “Content-Type: application/json” -XPOST “http://xx.1x1.x.210:8088/services/collector/event” -d '
{
“d”: “xxx”,
“timestamp”: “Sat Dec 15 13:19:36 2019”,
“status”: “up”
}'

But then you'll probably find the data structures don't match. The HTTP Event Collector expects events to arrive in a specific format. See https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_....

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!