Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mark-jones
mark-jones
Explorer
Member since:
09-12-2022
11-17-2022
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 09-12-2022 |
Activity Feed
- Got Karma for Re: Is there an error in the documentation? My tests indicate the document is not correct when using curl.. 09-20-2022 09:41 AM
- Posted Is it possible to rename a HEC under Data Inputs » HTTP Event Collector ? on Getting Data In. 09-20-2022 08:59 AM
- Posted Re: Is there an error in the documentation? My tests indicate the document is not correct when using curl. on Getting Data In. 09-20-2022 08:41 AM
- Posted Is there an error in the documentation? My tests indicate the document is not correct when using curl. on Getting Data In. 09-20-2022 07:12 AM
- Posted What date format does splunk HTTP Event Collector use? on Getting Data In. 09-19-2022 10:21 PM
- Posted RE: HTTP Event Collector target index- Is there a way to specify in the curl command the target index? on Getting Data In. 09-16-2022 04:14 PM
- Posted Re: Which inbound/outbound ports should be opened to send data to HTTP Event Collector on Getting Data In. 09-13-2022 09:50 AM
- Posted Which inbound/outbound ports should be opened to send data to HTTP Event Collector? on Getting Data In. 09-12-2022 08:39 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-20-2022
08:59 AM
Does anyone know if it's possible to rename an HEC or do you have to create a new one and update the token everywhere? Seems like just renaming it should be an option under edit, but not seeing anything. Thanks,
... View more
Labels
- Labels:
-
HTTP Event Collector
09-20-2022
08:41 AM
1 Karma
Done.
... View more
09-20-2022
07:12 AM
According to my tests the Authorization header should not have a space between the colon and splunk keyword. It should be "Authorization:Splunk ###-####..." and not "Authorization: Splunk ###-####..." https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/FormateventsforHTTPEventCollector In other words this works: curl -k https://prd-p.splunkcloud.com:8088/services/collector -H "Authorization:Splunk ###-######" -d "{\"sourcetype\":\"_json\",\"index\": \"job1\",\"event\": {\"a\": \"value1\", \"b\": [\"value1\", \"value1\"]}}" Whereas this does not work: curl -k https://prd-p.splunkcloud.com:8088/services/collector -H "Authorization: Splunk ###-######-b680-72c7bd33f9bb" -d "{\"sourcetype\":\"_json\",\"index\": \"job1\",\"event\": {\"a\": \"value1\", \"b\": [\"value1\", \"value1\"]}}"
... View more
Labels
- Labels:
-
HTTP Event Collector
09-19-2022
10:21 PM
I want to parse local log files and add the date to the body of the post request, but not exactly certain what is the best date form at to use? Can someone please provide some example options? Thank You, Mark $params = @{
Uri = 'https://prd-p.splunkcloud.com:8088/services/collector'
Method = 'POST'
Headers = @{
Authorization = 'Splunk 2caf8cde'
}
Body = @{
index = 'job1'
sourcetype = '_json'
event = @{
name1 = "value1"
name2 = "value2"
array1 = @(
"value1"
"value2"
)
}
} | ConvertTo-Json
}
Invoke-RestMethod -SkipCertificateCheck @params
... View more
Labels
- Labels:
-
HTTP Event Collector
09-16-2022
04:14 PM
Hello,
Is there a way to specify in the curl command the target index?
For example with the following command, how can i target an index named: scheduler in the command line?
curl -k https://prd-plot.splunkcloud.com:8088/services/collector -H "Authorization:Splunk #####-4f99-b680-72c7bd33f9bb" -d "{\"sourcetype\"😕"_json\",\"event\": {\"a\": \"value1\", \"b\": [\"value1_1\", \"value1_2\"]}}"
Thanks,
Mark
... View more
Labels
- Labels:
-
HTTP Event Collector
09-13-2022
09:50 AM
Hi scelikok Thank you for the info. If the trial Splunk Cloud does not allow changing the global settings to disable https, then i am now running into the issue with the following error message when trying to perform a simple curl command to test sending data to the indexer. curl https://prd-p-dfnly.splunkcloud.com:8088/services/collector/event -H "Authorization: Splunk d44e106b-####-####-####-e7a44409e65c" -d "{\"event\": \"hello world\"}\" {\"text\": \"Success\", \"code\": \"0}" curl: (60) SSL certificate problem: self signed certificate in certificate chain More details here: https://curl.haxx.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. I verified the outbound ports are open and was able to ping prd-p-dfnly.splunkcloud.com:8088
... View more
09-12-2022
08:39 PM
Hello,
I understand that the HTTP Event Collector receives data over HTTPS on TCP port 8088 by default.
What i am wondering is if i have virtual machines running in the Azure cloud, do i need to open both inbound and outbound port 8088 in the Azure portal firewall settings?
Also, I was hoping to disable HTTPS by clicking on the Global Settings button at the top of the HTTP Event Collector management page in Splunk Cloud, but i see that it's greyed out. I am in the admin role so is this changeable?
... View more
Labels
- Labels:
-
HTTP Event Collector
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-17-2022
03:11 PM
|
