Getting Data In

Splunk 6.5.2: Why am I unable to add data via HTTP Event Collector?

phagunbaya
Explorer

Working with Splunk 6.5.2. Using following curl command data ingestion fails:

$ curl -k  https://localhost:8088/services/collector/event -H "Authorization: Splunk D61EE079-8108-4DC8-ADF6-F139402993" -d "{\"hello\": \"world\"}"

Response:

{"text":"No data","code":5}

This was working fine with Splunk 6.3 and 6.4.

1 Solution

phagunbaya
Explorer

Issue was that HEC accepts data in specified format. Sending data as {"time": "", "event":{"hello": "world"}} worked.

View solution in original post

phagunbaya
Explorer

Issue was that HEC accepts data in specified format. Sending data as {"time": "", "event":{"hello": "world"}} worked.

aaraneta_splunk
Splunk Employee
Splunk Employee

@phagunbaya - Did the answer provided by starcher help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

starcher
Influencer

Check that you do not have useDeploymentServer = 1 in the HEC config on your HF. You ONLY want that on at the DS. Sending it down to the HF causes it to look for tokens etc under deployment-apps instead of apps.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...