Hi I am getting the below error while sending the login event from my website to Splunk.
Server returned HTTP response code: 400 for URL: http://localhost:8088/services/collector.
I have check vial curl command
curl -k "http://localhost:8088/services/collector" \ -H "Authorization: Splunk c14********************44f5" \ -d '{"event": "Hello, world!", "sourcetype": "manual"}'{"text":"Data channel is missing","code":10}curl: (6) Could not resolve host: \
curl: (6) Could not resolve host: \
curl: (6) Could not resolve host: Hello, world!,
curl: (6) Could not resolve host: sourcetype
curl: (3) [globbing] unmatched close brace/bracket in column 7
Please let me know what is missing I have also enabled HTTP Event Collector from global settings. I am using latest version of splunk Version:8.0.6
Hi @P01YOGESHC , please give a try on the sample below.
I ran a test in my sandbox to index raw events and I have to add the channel plus token to get data indexed
In order to get the channel, please run this query on splunk srv.
index="_internal" sourcetype=splunkd host=<server_name> | search guid!=" " | stats latest(host) latest(guid)
In my test I used the ip address, but you can try the FQDN as well, then you can add the guid to the channel and the token after Authorization:Splunk
I also added the index and sourcetype to the comment
This sample works properly for raw event.
The server name should be the one where the HEC is setup to receive the data
curl -k "https://XXX.X.XXX.XXX:8088/services/collector/raw?channel=23XXXXX-XXX-XXXX-XXXX-XXXXXXXXXX&sourcetype=httpevent&index=main" -H "Authorization: Splunk 46XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" -d '1, 2, 3... Hello, world!'
for further information, please check other samples at https://docs.splunk.com/Documentation/Splunk/8.0.6/Data/HECExamples
If this helps, please upvote. thanks
Hi @P01YOGESHC
Give this a try, and make sure your other server can resolve your splunk instance DNS, if not use the IP. Also, check SSL on url (http or https) and replace HEC token.
curl -k "http://DNS_OR_IP:8088/services/collector" -H "Authorization: Splunk C*****4-3**9-4**5-A**C-3**********7" -d '{"event": "Hello, world!", "sourcetype": "manual"}'