2

I've installed the Splunk Enterprise trial. I've enabled the HTTP Event Collector feature as described here which enables sending machine data from my app into Splunk.

I tried to send a POST request using Postman to Splunk and got no response.

method: POST
url : http://localhost:8088/services/collector
Authorization : my generated token
  1. Why there is no response if I already enabled the HEC feature? It seems that no server listens on that port at all.
  2. What I don't understand about Splunk is -- where is my data stored? Is data for Splunk Enterprise stored only locally and should be in use inside companies LAN network? Or Splunk's own servers in the cloud that stored all my data? Are Splunk Enterprise and Splunk Cloud different on that subject?
freginold
  • 3,946
  • 3
  • 13
  • 28
Hen Bar Levi
  • 111
  • 7

1 Answers1

0

You have 2 choices, send JSON data using HEC event data format specification for ex.

curl -k "https://mysplunkserver.example.com:8088/services/collector" \
-H "Authorization: Splunk CF179AE4-3C99-45F5-A7CC-3284AA91CF67" \
-d '{"event": "Hello, world!", "sourcetype": "manual"}'

Or send raw data, for this you need to use the raw endpoint, for ex.

curl -k
"https://mysplunkserver.example.com:8088/services/collector/raw?channel=00872DC6- 
AC83-4EDE- -H "Authorization: Splunk CF179AE4-3C99-45F5-A7CC-3284AA91CF67" -d '1,
2, 3... Hello, world!'
Gabriel Hernandez
  • 565
  • 6
  • 16