Splunk Enterprise HEC not sending data - splunk

I've installed the Splunk Enterprise trial. I've enabled the HTTP Event Collector feature as described here which enables sending machine data from my app into Splunk.
I tried to send a POST request using Postman to Splunk and got no response.
method: POST
url : http://localhost:8088/services/collector
Authorization : my generated token
Why there is no response if I already enabled the HEC feature? It seems that no server listens on that port at all.
What I don't understand about Splunk is -- where is my data stored? Is data for Splunk Enterprise stored only locally and should be in use inside companies LAN network? Or Splunk's own servers in the cloud that stored all my data? Are Splunk Enterprise and Splunk Cloud different on that subject?

You have 2 choices, send JSON data using HEC event data format specification for ex.
curl -k "https://mysplunkserver.example.com:8088/services/collector" \
-H "Authorization: Splunk CF179AE4-3C99-45F5-A7CC-3284AA91CF67" \
-d '{"event": "Hello, world!", "sourcetype": "manual"}'
Or send raw data, for this you need to use the raw endpoint, for ex.
curl -k
"https://mysplunkserver.example.com:8088/services/collector/raw?channel=00872DC6-
AC83-4EDE- -H "Authorization: Splunk CF179AE4-3C99-45F5-A7CC-3284AA91CF67" -d '1,
2, 3... Hello, world!'

Related

Configure HEC to Use User Provided Certificate - Splunk Cloud

I am forwarding events from a DBaaS to a Splunk instance hosted on Cloud.
Provisioned a Splunk Cloud instance (free trial license).
Created a new index in the instance I just created.
Created a new HTTP Endpoint Collector (HEC) forwarding metrics to the new index created.
I verified that the HEC was online with the following:
curl -k "https://***-*-*****.splunkcloud.com:8088/services/collector" \
-H "Authorization: Splunk ${splunk_token}" \
-d '{"event": "Hello, world!", "sourcetype": "manual"}'
All good.
The HEC includes a self-signed certificate by default. That just won't work for me. I can't find a way to configure it to use a custom cert. Can someone point me in the right direction?
You should be able to do that by creating a custom app and including the HEC info in an inputs.conf file along with your certificate chain. See https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-secure-the-event-collector-port-8088-with-an-ssl/m-p/243885 for more info. The thread is old, but most of the information still applies.

How to compose a curl request correctly for wso2 api manager

Description:
I have configured an API (http://localhost:8280/GPNAPI2/1.0.0) that has Production and Sandbox endpoints (http://sparkgatetest.interfax.ru/iFaxWebService/iFaxWebService.asmx). All I need is to send a curl request to http://localhost: 8280/GPNAPI2/1.0.0, but receive a response from http://sparkgatetest.interfax.ru/iFaxWebService/iFaxWebService.asmx. As I understand it, wso2 am is needed for this, so that several external APIs can be connected to one gateway. I also created a subscription for http://localhost:8280/GPNAPI2/1.0.0.
Steps to reproduce:
I pass a GET request to http://localhost:8280/GPNAPI2/1.0.0 and pass a security token in the request, for example:
curl -X GET "http://localhost:8280/GPNAPI2/1.0.0" -H "accept: */ *" -H "Authorization: Bearer eyJ4NXQiOiJNell4TW1Ga09HWXdNV0kwWldObU5EY3hOR1l3WW1NNBelpUQTR"
Everything is going well. But I don't know how to transfer data to the endpoint in one request: http://sparkgatetest.interfax.ru/iFaxWebService/iFaxWebService.asmx
A request of this type:
curl -c cookies.txt -i -X ​​--location --request POST 'http://sparkgatetest.interfax.ru/iFaxWebService/iFaxWebService.asmx'
--header 'Content-Type: text / xml'
--header 'SOAPAction: http://interfax.ru/ifax/Authmethod'
--data '
<soap: Envelope xmlns: xsi = "http://www.w3.org/2001/XMLSchema-instance" xmlns: xsd = "http://www.w3.org/2001/XMLSchema" xmlns: soap = "http : //schemas.xmlsoap.org/soap/envelope/ ">
<soap: Body>
******
*****
</ soap: Body>
</ soap: Envelope> '
I want to understand how to combine these two requests into one, and whether it needs to be done. After all, my task, when accessing http://localhost: 8280/GPNAPI2/1.0.0, is actually working with http://sparkgatetest.interfax.ru/iFaxWebService/iFaxWebService.asmx
Affected Product Version:
wso2 apim 3.2.0 (We need this particular version, since the customer is using it and, for reasons I do not understand, does not want to switch to version 4.0.0).
Environment details (with versions):
windows 8
Please help me with my problem.
You can follow the documentation to expose your SOAP service as a REST API using API Manager 3.2.0.
Basically, you have to provide your WSDL url in the first step (for example, http://sparkgatetest.interfax.ru/iFaxWebService/iFaxWebService.asmx?wsdl) and then continue as mentioned in the documentation.
If you go to the Resources section in Publisher portal, you'll be able to see SOAPAction header and SOAPRequest body parameters are defined. Also, under the WSDL Definition section in the Publisher you'll be able to see the complete WSDL definition of your SOAP service. If you follow rest of the steps you'll be able to invoke the API by providing necessary header and body parameters through APIM devloper portal.

URLFetchApp with certificate: Google scripts with Apple ads reporting API

Hi I'm attempting to pull data from the Apple Ads API into a Google sheet, and I'm getting completely stuck on providing the security certificates. I've been able to successfully pull my data using Postman, so I'm comfortable that I can structure the request properly.
I'm trying to use URLFetchApp, but I can't see any means of including the PEM and KEY file, or even using the curl example provided by Apple of combining to the P12 file. Am I missing something here or is URLFetchApp unable to complete this?
It doesn't appear to me that this would fit into any of the existing headers for URLFetchApp https://developers.google.com/apps-script/reference/url-fetch/url-fetch-app#fetchurl-params
curl \
--cert ./<FILENAME>.p12 \
--pass <PASSWORD> \
-H "Authorization: orgId=<ORG_ID>" \
-H "Content-Type: application/json" \
-d "<CAMPAIGN_DATA_FILE>.json" \
-X POST "https://api.searchads.apple.com/api/v1/campaigns"
You're right in that Google Apps Script (GAS) does not support client-side SSL certificates in their UrlFetchApp class, which appears to be their only way to make outbound HTTP(S) requests.
Your best bet is probably to make a custom Google Apps Engine (GAE) in a language of your choice and expose an endpoint from there which when called from GAS will make a new request to your destination and provide the needed certificates. However, GAE is not free like GAS (since Google changed their cloud terms of service a couple years back), so that's something to keep in mind.

MobileFirst 6.3 : How to use REST API Adapter (POST) and Application (POST)

MobileFirst Platform 6.3
I want to use REST API to administer the runtime environments concerning adapters, applications, devices, audit, transactions, security, and push notifications.
http://www-01.ibm.com/support/knowledgecenter/SSHS8R_6.3.0/com.ibm.worklight.apiref.doc/apiref/c_restapi_oview.html?lang=fr
That works fine for Request with method GET. But for Method POST i don't find what information i need to send for adapter deployment or application deployment.
http://www-01.ibm.com/support/knowledgecenter/SSHS8R_6.3.0/com.ibm.worklight.apiref.doc/apiref/r_restapi_adapter_post.html?lang=fr
what key/value are needed for Adapter (POST) request?
The transmitted data in the Adapter POST API must be a multipart/form-data containing as single file the adapter binary. So it is not some key/value JSON payload, it is rather a payload for a binary file upload.
If you know curl, you can send a file named myadapter.adapter this way:
curl -u user:password -i -H "Accept: application/json" -H "Content-Type: multipart/form-data" -X POST http://www.example.com/worklightadmin/management-apis/1.0/runtimes/MyProject/adapters?async=false --form "data=#myadapter.adapter"
Please adapt user, password and server address in this example.
It is similar for the Application POST API, here you send the wlapp file.
For examples of multipart/form-data in general, see http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.
You need to specify body rather than parameters, and may need to specify some header information
{
method : 'post',
path : 'xxxxxxx',
headers: {'Content-Type' : 'application/json'},
body : { ... arbitrary data here ... } };
}

Any example of using https:inbound-endpoint of mule?

I wanted to use mule ESB to access a rest api periodically, and save the response JSON to disk.
Basically, I need to use https:inbound-endpoint to perform something like:
curl -H "Authorization: Bearer XXXXX" -k https://somehost.com/api
in mule.
Any working example for me to start with?
Basically you need to configure the https connector and create a keystore or use the one on the JDK.
The mule documentation page contains a very simple example with step-by-step settings.