Getting Data In

Splunk 6.5.2: Why am I unable to add data via HTTP Event Collector?

phagunbaya
Explorer

Working with Splunk 6.5.2. Using following curl command data ingestion fails:

$ curl -k  https://localhost:8088/services/collector/event -H "Authorization: Splunk D61EE079-8108-4DC8-ADF6-F139402993" -d "{\"hello\": \"world\"}"

Response:

{"text":"No data","code":5}

This was working fine with Splunk 6.3 and 6.4.

1 Solution

phagunbaya
Explorer

Issue was that HEC accepts data in specified format. Sending data as {"time": "", "event":{"hello": "world"}} worked.

View solution in original post

phagunbaya
Explorer

Issue was that HEC accepts data in specified format. Sending data as {"time": "", "event":{"hello": "world"}} worked.

View solution in original post

aaraneta_splunk
Splunk Employee
Splunk Employee

@phagunbaya - Did the answer provided by starcher help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

starcher
SplunkTrust
SplunkTrust

Check that you do not have useDeploymentServer = 1 in the HEC config on your HF. You ONLY want that on at the DS. Sending it down to the HF causes it to look for tokens etc under deployment-apps instead of apps.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!