Hello Splunk experts,
I have been experimenting with the Http Event Controller for Splunk Enterprise and was trying to POST , JSON data, with the 'fields' parameter in order to allow better indexing.
I am using this http://dev.splunk.com/view/event-collector/SP-CAAAFB6
The request is:
curl -k https://mysplunkserver.example.com:8088/services/collector/event -H "Authorization: Splunk 12345678-1234-1234-1234-1234567890AB" -d '{"event": "Hello, McKinley High!", "sourcetype": "_json", "fields": {"club":"glee", "wins",["regionals","nationals"]}}' . However, this results in an error in the logs:
ERROR JsonLineBreaker - JSON StreamId:0 had parsing error:Unexpected character while looking for value: 'H' - data_source="http:force_ocr", data_host="localhost:8088", data_sourcetype="_json"
Is the example in the splunk documentation incorrect? What is the right way to use the 'fields' parameter?
Thank you for helping out here!
... View more