Skip to content

Instantly share code, notes, and snippets.

@MirzaMerdovic
Last active May 21, 2019 11:41
Show Gist options
  • Save MirzaMerdovic/1898943cce2536e794a8cd9169e65597 to your computer and use it in GitHub Desktop.
Save MirzaMerdovic/1898943cce2536e794a8cd9169e65597 to your computer and use it in GitHub Desktop.
I had trouble figuring out the message format that Splunk expects when you won't to post a message to exposed http event collector,
so there it is for future references since I will forget about it 100%
URL: http://localhost:8088/services/collector/event
headers:
- Authorization = Splunk {your_token}
- Content-Type = application/json
json payload:
{
"source" : "Postman",
-- If there is nothing really specific having this value as '_json' should be prefered since it is one of Splunk standard source types
"sourcetype" : "PostmanLog",
-- Index must exsist!
"index" : "postman",
"event": {
-- These are custom properties.
"level": "Error",
"message": "Splunk error from Postman."
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment