I am sending a request to Splunk using .NET code which returns a response of (400) Bad Request.
The bytes are seen as received by Splunk in the log file http_event_collector_metrics however there seems to be some parsing error flag getting set "num_of_parser_errors":1. The index search does not show any data being received.
Similar request using the same token is working with Python. What could be the problem in below .NET code ?
Code is as below:
class Program
{
static void Main(string[] args)
{
WebRequest request = WebRequest.Create("http://localhost:8088/services/collector/event");
request.ContentType = "application/json";
request.Method = "POST";
request.Headers.Add("Authorization", "Splunk 6d8a53cd-eb65-4a1d-abb9-6dc8ad01e616");
string strjson = "{\"QUEUE\":\"STARTED\"," +
"\"STATUS\":\"SUCCESS\"}";
try
{
using (var streamWriter = new StreamWriter(request.GetRequestStream()))
{
streamWriter.Write(strjson);
streamWriter.Flush();
streamWriter.Close();
}
var httpResponse = (HttpWebResponse)request.GetResponse();
using (var streamReader = new StreamReader(httpResponse.GetResponseStream()))
{
var result = streamReader.ReadToEnd();
System.Diagnostics.Debug.WriteLine("Data sent to splunk...." );
System.Diagnostics.Debug.WriteLine(result);
}
}
catch (Exception e)
{
System.Diagnostics.Debug.WriteLine(e);
}
}
}
Note the
Ok have solved it the problem with DotNet code was with the JSON string. Changing it to below solved the problem.
string strjson = "{ \"event\": \"{QUEUE:STARTED,STATUS:SUCCESS}\"}";
With Python it is already working for me as mentioned in my original query. Need to know how to work with .NET
You are missing a lot of the expected fields for a JSON HEC event. Such as index, sourcetype, host, source etc as metadata then your event data should be in a field called event. I don't know .net but here is example in python. It should give you idea on building your JSON to post.