Here is an example of posting data to a Splunk HEC url for injesion:

def post_to_splunk(hec_endpoint, hec_token, data):
    '''
        Posts to Splunk endpoint the data in JSON format

        Parameters:
        hec_endpoint (str): The HEC endpoint, including base url
        hec_token (str): The HEC token
        data (dict): The secret to lookup value for
    '''

    headers = {
        'Authorization': f'Splunk {hec_token}',
        'Content-Type': 'application/json'
    }

    response = requests.post(hec_endpoint, headers=headers, data=json.dumps(data))

    if response.status_code == 200:
        print("Event sent successfully.")
    else:
        print(f"Failed to send event. Status code: {response.status_code}, Response: {response.text}")

No comments