- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hello Splunk Community
The file is not really subject to change, but can be changed easily if required. I wish I could use the Splunk SNMP module, but I need some sort of API key (BaboonBones!??!)
I can use the script outside of splunk to create a “log” file then have splunk read the file. Maybe that is the best way, I am wondering if it is worthwhile to try to find the splunk python splunklib.client module and use it to send data, etc.
I am open to suggestions.
Thanksl,
eholz1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Another option is if you want to run the python outside of Splunk for some reason. Send your data in via HTTP event collector.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Another alternative is REST API (Endpoints reference list, see under receiv ers/). Some pros and cons for your consideration.
Pro | Con | |
Scripted input | Simple, arguably the lowest cost | Every event carries the name of Spunk server/forwarder as host value |
HEC | Allows setting of various meta data for each event, such as host | Specialized interface, some setup |
REST API, e.g., | Allows setting of various meta data for each event, such as host | Requires authentication |
File dump-ingestion | Simple to implement, can set host field per event via path/file name | If use path/file name for event, make sure each batch does not contain duplicate path/file name. |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hello All,
Thanks for the tips. I managed to get an HEC set up on the Splunk indexer.
I can go to a remote computer and do a curl command like this, which does send data to the indexer:
curl -k https://Indexer:8088/services/collector/event -H "Authorization: Splunk 6959a730-556f-4d91-6d94-a6f63fdfb72e" -d '{"event": "amazing transfer of hello world"}'
I am attempting to use a python program with the "requests" module imported, and it seem I need the urllib3 module as well.
I am using json for my header, and json for my data
header { "Authorization": "Splunk <token code from the HEC>" }
et = {"event": "UP hello world, etc" }
my request is this:
req = requests.post(url,headers=header,data=et,verify=False)
This fails with 400, Bad Request.
What am I missing here?
thanks
eholz1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Why do you need JSON for auth header? As your cURL command demonstrated, it should be a colon-separated key-value pair.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Another option is if you want to run the python outside of Splunk for some reason. Send your data in via HTTP event collector.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hello All,
Thanks for all the replies Yes, I used the HEC, and finally got everyting working.
I am using the request module to send the data to splunk. The tricking part was making the data value a STRING. The authorization goes through fine in the "json" format.
Thanks for the support
eholz1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Wow two good ideas. I will try it out. One of my main questions would be monitoring a flle or using a
script - is one method better that the othe?
In my case, I might have to try the http event collector.
Thanks,
eholz
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Getting data into Splunk from a Python script is easy. Run the script as a Splunk scripted input (Settings->Data inputs->scripts). Anything the script writes to stdout will be indexed automatically - no client module needed.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hello richgalloway,
Again thanks for the tip here, both replies are VERY helpful, If there is a way to give you each 20 karmas
I would.
I will try the script method as well,
eholz1
