Hi @P01YOGESHC , please give a try on the sample below. I ran a test in my sandbox to index raw events and I have to add the channel plus token to get data indexed In order to get the channel, please run this query on splunk srv.  index="_internal" sourcetype=splunkd host=<server_name> | search guid!=" " | stats latest(host) latest(guid) In my test I used the ip address, but you can try the FQDN as well, then you can add the guid to the channel and the token after Authorization:Splunk I also added the index and sourcetype to the comment This sample works properly for raw event. The server name should be the one where the HEC is setup to receive the data curl -k "https://XXX.X.XXX.XXX:8088/services/collector/raw?channel=23XXXXX-XXX-XXXX-XXXX-XXXXXXXXXX&sourcetype=httpevent&index=main" -H "Authorization: Splunk 46XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" -d '1, 2, 3... Hello, world!' for further information, please check other samples at https://docs.splunk.com/Documentation/Splunk/8.0.6/Data/HECExamples If this helps, please upvote. thanks ... View more