Why am I unable to pull any events, even though I receive a success message from cURL?

[mdeep]

Hi ,

I am not able to pull events , even I got success message from cURL .Here is my command.

               curl -k -v http://localhost:8088/services/collector/event -H "Authorization: Splunk 5B7C169D-6415-4D56-97E9-2A836E48346E" -d '{"event":"Hello, World!","index":"tomcat_logs"}'
*   Trying xxx.xx.xx.xx...
* Connected to localhost (xxx.xx.xx.xx) port 8088 (#0)
> POST /services/collector/event HTTP/1.1
> Host: localhost:8088
> User-Agent: curl/7.43.0
> Accept: */*
> Authorization: Splunk 5B7C169D-6415-4D99-97E9-2A836E48346E
> Content-Length: 47
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 47 out of 47 bytes
< HTTP/1.1 200 OK
< Date: Tue, 15 Nov 2016 20:53:47 GMT
< Content-Type: application/json; charset=UTF-8
< X-Content-Type-Options: nosniff
< Content-Length: 27
< Vary: Authorization
< Connection: Keep-Alive
< X-Frame-Options: SAMEORIGIN
< Server: Splunkd
< 
* Connection #0 to host localhost left intact
{"text":"Success","code":0}

But when I search with index = *, it's not displaying any events.

Thanks,
Mani

[mdeep · Accepted solution]

Yes , but I found the solution. During Event Collector set up I have mention sourcetype as _json, and later I have changed the sourcetype. Now able to pull the events .Thank you guys

[somesoni2]

When you setup your Event Collector input to generate authorization token, you would've specified index and sourcetype etc. Try searching with that to see if the data is available.

[mdeep]

I tried with those index and source type but there is no result

[richgalloway]

Are you searching All Time?