splunk - hec curl examples

hec_examples.sh

# - https://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHECIDXAck
# - https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector
# - https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples

# NOTE: events sent to the RAW endpoint will land in the default index for the provided token

# event endpoint [ack disabled]
curl -k \
    -H "Authorization: Splunk TH1S-IS-N0T-A-R3AL-T0K3N" \
    https://splunk-heavyforwarder:8088/services/collector/event \
    -d '{ "index": "testing", "sourcetype": "_json", "event": {"greeting": "hello, world"} }'


# raw endpoint [ack disabled]
curl -k \
    -H "Authorization: Splunk TH1S-IS-N0T-A-R3AL-T0K3N" \
    https://splunk-heavyforwarder:8088/services/collector/raw \
    -d '{"greeting": "hello, world"}'


# event endpoint [ack enabled]
curl -k \
    -H "Authorization: Splunk TH1S-IS-N0T-A-R3AL-T0K3N" \
    -H "X-Splunk-Request-Channel: $(/usr/bin/uuid)" \
    https://splunk-heavyforwarder:8088/services/collector/event \
    -d '{ "index": "testing", "sourcetype": "_json", "event": {"greeting": "hello, world"} }'


# raw endpoint [ack enabled]
curl -k \
    -H "Authorization: Splunk TH1S-IS-N0T-A-R3AL-T0K3N" \
    -H "X-Splunk-Request-Channel: $(/usr/bin/uuid)" \
    https://splunk-heavyforwarder:8088/services/collector/raw \
    -d '{"greeting": "hello, world"}'



# batching - event endpoint
curl -k \
    -H "Authorization: Splunk TH1S-IS-N0T-A-R3AL-T0K3N" \
    https://splunk-heavyforwarder:8088/services/collector/event \
    -d '{
            "index": "testing",
            "sourcetype": "_json",
            "event": {
                "greeting": "hello, earth"
            }
        }
        {
            "index": "testing",
            "sourcetype": "_json",
            "event": {
                "greeting": "hello, jupiter"
            }
        }
        {
            "index": "testing",
            "sourcetype": "_json",
            "event": {
                "greeting": "hello, saturn"
            }
        }'

# batching - raw endpoint        
curl -k \
    -H "Authorization: Splunk TH1S-IS-N0T-A-R3AL-T0K3N" \
    https://splunk-heavyforwarder:8088/services/collector/raw \
    -d '127.0.0.1 - anonymous [30/09/24:12:51:31.244897135 +1000] "GET /index.html HTTP/1.0" - 200 2480 - - - 8ms
127.0.0.1 - anonymous [30/09/24:12:51:32.248867305 +1000] "GET /index.html HTTP/1.0" - 200 2929 - - - 1ms
127.0.0.1 - anonymous [30/09/24:12:51:33.253465408 +1000] "GET /help.html HTTP/1.0" - 200 4966 - - - 4ms
127.0.0.1 - anonymous [30/09/24:12:51:34.257957729 +1000] "GET /services.html HTTP/1.0" - 200 2236 - - - 1ms
127.0.0.1 - anonymous [30/09/24:12:51:35.264439819 +1000] "GET /about.html HTTP/1.0" - 200 2042 - - - 10ms
127.0.0.1 - anonymous [30/09/24:12:51:36.269354858 +1000] "GET /events.html HTTP/1.0" - 200 462 - - - 1ms
127.0.0.1 - anonymous [30/09/24:12:51:37.272490357 +1000] "GET /pricing.html HTTP/1.0" - 200 3296 - - - 4ms
127.0.0.1 - anonymous [30/09/24:12:51:38.275468027 +1000] "GET /admin.html HTTP/1.0" - 200 752 - - - 3ms
'