You need to pre-pend the hostname with input-. curl -k https://input-xxxxx.cloud.splunk.com:8088/services/collector -H "Authorization: Splunk token" -d '{"event":{"laptop":"macbook","os":"freebsd","version":"11.3"}}' ... View more