I had the same problem and this worked for me: - name: Create a hec token uri: url: https://localhost:8089/servicesNS/nobody/your_app/data/inputs/http?output_mode=json user: admin password: your_password method: POST body_format: form-urlencoded body: - [ name, token_name ] - [ index, your_index ] - [ sourcetype, your_sourcetype ] ... View more

This is a script you are running ad-hoc or as part of an alert? The script we are having the issue with is being run as a script action. ... View more

This fixed my problem too. Thanks ... View more