Getting Data In

Why is c# logging to HTTP Event Collector not working?

rvencu
Path Finder

I am trying to send events from my Windows server .NET app to Splunk index via HTTP Event Collector.

I was able to setup the collector and verified it from localhost and from another Linux machine by using simple curl commands as documented, so the collector is listening and is adding data to the index as supposed to do.

However when trying to send events from .NET c# app I face the impossible. I tried all sample code Splunk made available, from simple to complex with no good results.

Now, since the curl is working I am trying to do the very basic curl emulation in c# via a webrequest object. I am stuck now with the authentication. I tried various authentication headers but it seems none wants to work. The ones with encryption generates 400 Bad Request. The simple one from the code sample below generates 401 Unauthorized.

I need some help to solve this issue.

WebRequest request = WebRequest.Create("https://splunkserver:8088/services/collector/event");

request.Method = "POST";

request.Headers.Add("Authorization", "splunk 1EDC2170-023A-468A-9ADD-8A879755DC74");

ASCIIEncoding encoding = new ASCIIEncoding();
byte[] byte1 = encoding.GetBytes("this is a raw event line");
request.ContentLength = byte1.Length;
Stream newStream = request.GetRequestStream();
newStream.Write(byte1, 0, byte1.Length);

WebResponse response = request.GetResponse();

Stream dataStream = response.GetResponseStream();`

StreamReader reader = new StreamReader(dataStream);`

string serverResponse = reader.ReadToEnd();
1 Solution

rvencu
Path Finder

Solved. The authorization header REQUIRED the username to be Splunk not splunk. So the C# emulation of the curl command is working well now.

The PHP version is not yet but I do not need it anymore.

View solution in original post

0 Karma

rvencu
Path Finder

Solved. The authorization header REQUIRED the username to be Splunk not splunk. So the C# emulation of the curl command is working well now.

The PHP version is not yet but I do not need it anymore.

0 Karma

rvencu
Path Finder

One more issue. From the windows machine where I installed curl for basic testing, the same curl command that gets logged from linux machine is throwing this error

{"text":"Invalid data format","code":6,"invalid-event-number":0}

0 Karma

rvencu
Path Finder

OK, that one required getting rid of single quotes like this:
-d "{\"event\": \"hello world\"}"
It works fine now. Still from C# there no progress whatsoever...

0 Karma

rvencu
Path Finder

And this code in PHP (ran from a linux machine) will produce the same error

$data = array("event"=>"php test");
$data_string = json_encode($data);

$ch = curl_init();
$headr = array();
$headr[] = 'Content-Type:application/json';
$headr[] = 'Authorization: Splunk 1EDC2170-023A-468A-9ADD-8A879755DC74';
$headr[] = 'Content-Lenght: ' . strlen(data_string);

curl_setopt($ch, CURLOPT_HTTPHEADER,$headr);
curl_setopt($ch, CURLOPT_URL,"https://splunkserver:8088/services/collector/event");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, data_string);

// receive server response ...
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$server_output = curl_exec ($ch);

curl_close ($ch);

echo $server_output;
echo "<div>".$data_string."</div>";`

will generate
{"text":"Invalid data format","code":6,"invalid-event-number":0}
{"event":"php test"}

Baffled what is wrong with the data format...

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...