Getting Data In

What are the Unsupported Characters for HEC

teixeie
Engager

Hi Splunk,

It seems that sending log messages to Splunk HEC endpoints containing "\n", or "\r" or "\t" causes the Hec endpoint to respond... "{"text":"Invalid data format","code":6,"invalid-event-number":0}". Anyone knows where one can find  the list of characters that are not permitted ?

Thank you,

Eduardo

0 Karma
1 Solution

ivanreis
Builder

Hi @teixeie , I was doing some research about it and I did not find any document or post that makes reference in how to scape those characters.
I found a document where they mentioned about this error "{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}  and how it can be fixed. The author is using the json format, and maybe it can be applied to your case, it is worth to try.

https://medium.com/adarma-tech-blog/splunk-http-event-collectors-explained-2c22e87ab8d2

Top Tips:

Double-quotes in the JSON Collector
When sending events that contain double-quotes (“”) or nested JSON structures, ie. a stream of text with JSON within “event” key, escape the double-quotes:
before: {“event”:”{“field1”:”value1"}”}
after: {“event”:”{\“field1\”:\”value1\"}”}
OR
before: {“event”:”[15/11/2019 11:00:00]“field1” ”field2"”}
after: {“event”:”[15/11/2019 11:00:00] \“field1\” \”field2\"”}
Otherwise Splunk will reply with:
{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}

If this help, please upvote. 

View solution in original post

ivanreis
Builder

Hi @teixeie , I was doing some research about it and I did not find any document or post that makes reference in how to scape those characters.
I found a document where they mentioned about this error "{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}  and how it can be fixed. The author is using the json format, and maybe it can be applied to your case, it is worth to try.

https://medium.com/adarma-tech-blog/splunk-http-event-collectors-explained-2c22e87ab8d2

Top Tips:

Double-quotes in the JSON Collector
When sending events that contain double-quotes (“”) or nested JSON structures, ie. a stream of text with JSON within “event” key, escape the double-quotes:
before: {“event”:”{“field1”:”value1"}”}
after: {“event”:”{\“field1\”:\”value1\"}”}
OR
before: {“event”:”[15/11/2019 11:00:00]“field1” ”field2"”}
after: {“event”:”[15/11/2019 11:00:00] \“field1\” \”field2\"”}
Otherwise Splunk will reply with:
{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}

If this help, please upvote. 

teixeie
Engager

Thank you Ivanreis!

Escaping those characters indeed resolved the issue. I will add escaping for double quotes as well.

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...