Installation

Server returned HTTP response code: 400 for URL: http://localhost:8088/services/collector

P01YOGESHC
Loves-to-Learn

Hi I am getting the below error while sending the login event from my website to Splunk.

Server returned HTTP response code: 400 for URL: http://localhost:8088/services/collector.

I have check vial curl command

curl -k "http://localhost:8088/services/collector" \ -H "Authorization: Splunk c14********************44f5" \ -d '{"event": "Hello, world!", "sourcetype": "manual"}'{"text":"Data channel is missing","code":10}curl: (6) Could not resolve host: \
curl: (6) Could not resolve host: \
curl: (6) Could not resolve host: Hello, world!,
curl: (6) Could not resolve host: sourcetype
curl: (3) [globbing] unmatched close brace/bracket in column 7

Please let me know what is missing I have also enabled HTTP Event Collector from global settings. I am using latest version of splunk Version:8.0.6

 

Labels (1)
0 Karma

ivanreis
Builder


Hi @P01YOGESHC , please give a try on the sample below.

I ran a test in my sandbox to index raw events and I have to add the channel plus token to get data indexed

In order to get the channel, please run this query on splunk srv. 

index="_internal" sourcetype=splunkd host=<server_name> | search guid!=" " | stats latest(host) latest(guid)

In my test I used the ip address, but you can try the FQDN as well, then you can add the guid to the channel and the token after Authorization:Splunk

I also added the index and sourcetype to the comment

This sample works properly for raw event.

The server name should be the one where the HEC is setup to receive the data
curl -k "https://XXX.X.XXX.XXX:8088/services/collector/raw?channel=23XXXXX-XXX-XXXX-XXXX-XXXXXXXXXX&sourcetype=httpevent&index=main" -H "Authorization: Splunk 46XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" -d '1, 2, 3... Hello, world!'

for further information, please check other samples at https://docs.splunk.com/Documentation/Splunk/8.0.6/Data/HECExamples

If this helps, please upvote. thanks

0 Karma

alemarzu
Motivator

Hi @P01YOGESHC 

Give this a try, and make sure your other server can resolve your splunk instance DNS, if not use the IP. Also, check SSL on url (http or https) and replace HEC token.

 

curl -k "http://DNS_OR_IP:8088/services/collector" -H "Authorization: Splunk C*****4-3**9-4**5-A**C-3**********7" -d '{"event": "Hello, world!", "sourcetype": "manual"}'

 

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...