POSTing to Splunk HEC URL
- Details
- Written by: JC
- Category: Programming
Here is an example of posting data to a Splunk HEC url for injesion:
def post_to_splunk(hec_endpoint, hec_token, data):
'''
Posts to Splunk endpoint the data in JSON format
Parameters:
hec_endpoint (str): The HEC endpoint, including base url
hec_token (str): The HEC token
data (dict): The secret to lookup value for
'''
headers = {
'Authorization': f'Splunk {hec_token}',
'Content-Type': 'application/json'
}
response = requests.post(hec_endpoint, headers=headers, data=json.dumps(data))
if response.status_code == 200:
print("Event sent successfully.")
else:
print(f"Failed to send event. Status code: {response.status_code}, Response: {response.text}")