Splunk Search

Why am I unable to pull any events, even though I receive a success message from cURL?

mdeep
Explorer

Hi ,

I am not able to pull events , even I got success message from cURL .Here is my command.

               curl -k -v http://localhost:8088/services/collector/event -H "Authorization: Splunk 5B7C169D-6415-4D56-97E9-2A836E48346E" -d '{"event":"Hello, World!","index":"tomcat_logs"}'
*   Trying xxx.xx.xx.xx...
* Connected to localhost (xxx.xx.xx.xx) port 8088 (#0)
> POST /services/collector/event HTTP/1.1
> Host: localhost:8088
> User-Agent: curl/7.43.0
> Accept: */*
> Authorization: Splunk 5B7C169D-6415-4D99-97E9-2A836E48346E
> Content-Length: 47
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 47 out of 47 bytes
< HTTP/1.1 200 OK
< Date: Tue, 15 Nov 2016 20:53:47 GMT
< Content-Type: application/json; charset=UTF-8
< X-Content-Type-Options: nosniff
< Content-Length: 27
< Vary: Authorization
< Connection: Keep-Alive
< X-Frame-Options: SAMEORIGIN
< Server: Splunkd
< 
* Connection #0 to host localhost left intact
{"text":"Success","code":0}

But when I search with index = *, it's not displaying any events.

Thanks,
Mani

0 Karma
1 Solution

mdeep
Explorer

Yes , but I found the solution. During Event Collector set up I have mention sourcetype as _json, and later I have changed the sourcetype. Now able to pull the events .Thank you guys

View solution in original post

0 Karma

mdeep
Explorer

Yes , but I found the solution. During Event Collector set up I have mention sourcetype as _json, and later I have changed the sourcetype. Now able to pull the events .Thank you guys

0 Karma

somesoni2
Revered Legend

When you setup your Event Collector input to generate authorization token, you would've specified index and sourcetype etc. Try searching with that to see if the data is available.

0 Karma

mdeep
Explorer

I tried with those index and source type but there is no result

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you searching All Time?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...