Getting Data In

unable to pass URL using curl command

anooshac
Communicator

Hi all,

I am passing some data in JSON format to Splunk using curl. When i try to pass the URL it gives an error " nested brace in URL position 19". Not getting where went wrong even though all the braces are proper. Can anyone help me in this?

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well, something must be wrong if you're getting an error. We can't know what it is without more details about your curl invocation.

0 Karma

anooshac
Communicator

I am using the following to add data. I am not supposed to share the data here so i have given one example.

curl https://aa-abc-abcd-data-abc.com:1234/abc/abc/raw -H "Authorization: Splunk abc-hwhuhw1-dshjhsj-whdedg" -d {\"DATA_SET\":{\"NUMBER\":\"75\",\"TASK_URL\":\"https://abc.com/xyz/task/abcabc/\",\"DATA_URL\":\"https://abc.com/xyz/source/dataName/com.abc.team.data.DATA/\",\"PARTS\":[\"NAME\":\"abc.abc.abc\",\"SUB\":\"12345-\"]}}

The URL has some issue.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Of course I didn't expect full raw data due to privacy issues 🙂

If you're typing this into shell, remember that you're hitting shell's expansion first.

See for yourself

$ echo {\"DATA_SET\":{\"NUMBER\":\"75\",\"TASK_URL\":\"https://abc.com/xyz/task/abcabc/\",\"DATA_URL\":\"https://abc.com/xyz/source/dataName/com.abc.team.data.DATA/\",\"PARTS\":[\"NAME\":\"abc.abc.abc\",\"SUB\":\"12345-\"]}}
{"DATA_SET":"NUMBER":"75"} {"DATA_SET":"TASK_URL":"https://abc.com/xyz/task/abcabc/"} {"DATA_SET":"DATA_URL":"https://abc.com/xyz/source/dataName/com.abc.team.data.DATA/"} {"DATA_SET":"PARTS":["NAME":"abc.abc.abc"} {"DATA_SET":"SUB":"12345-"]}

 That's probably not what you want.

You should at least surround whole parameter to -d with quotes.

And next time, try curl with -v to easier see whether the issue is with the curl invocation syntax and curl won't even try to connect to the server in the first place or is it with the parameters/data syntax so that the error is returned by the server.

0 Karma

anooshac
Communicator

I removed DATA_SET. Tried executing with -v and it says {"text":"The requested URL was not found on this server.","code":404}. I guess it searching for the URL in the server mentioned in curl command.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...