Splunk importing data through rest HTTP

Using HTTP Event Collector

Go to Settings > Data inputs > HTTP Event Collector. Then click the Global Settings button in the Upper-right corner. Then enable the settings!

And then go to add data, adding HTTP EC.

In the settings source type, select JSON.

When you're done, you'll generate a token!

Use the following command to import the data:

In the above configuration, where Xxtest is the HEC name I established:

Curl-k  https://localhost:8088/services/collector/event-  H "authorization:splunk e35f7010-b2dc-4061-b2ea-2870fc8ea546 "-d ' {" event ":" Hello World bone This is a temp test "," sourcetype ":" Xxtest "} '

You should now see the following response:

{"Text": "Success", "Code": 0}

Then go to the Splunk search interface, https://localhost:8000, input: source=xxtest, you can see the above data.

Other considerations: I set the SSL to true in the Splunk Web setting, which means that SSL is required to access it. may be affected by the above operations.

Reference:

Http://dev.splunk.com/view/event-collector/SP-CAAAE7F

Https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/UsetheHTTPEventCollector

Splunk importing data through rest HTTP