Getting Data In

What are the Unsupported Characters for HEC

teixeie
Engager

Hi Splunk,

It seems that sending log messages to Splunk HEC endpoints containing "\n", or "\r" or "\t" causes the Hec endpoint to respond... "{"text":"Invalid data format","code":6,"invalid-event-number":0}". Anyone knows where one can find  the list of characters that are not permitted ?

Thank you,

Eduardo

Labels (1)
0 Karma
1 Solution

ivanreis
Builder

Hi @teixeie , I was doing some research about it and I did not find any document or post that makes reference in how to scape those characters.
I found a document where they mentioned about this error "{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}  and how it can be fixed. The author is using the json format, and maybe it can be applied to your case, it is worth to try.

https://medium.com/adarma-tech-blog/splunk-http-event-collectors-explained-2c22e87ab8d2

Top Tips:

Double-quotes in the JSON Collector
When sending events that contain double-quotes (“”) or nested JSON structures, ie. a stream of text with JSON within “event” key, escape the double-quotes:
before: {“event”:”{“field1”:”value1"}”}
after: {“event”:”{\“field1\”:\”value1\"}”}
OR
before: {“event”:”[15/11/2019 11:00:00]“field1” ”field2"”}
after: {“event”:”[15/11/2019 11:00:00] \“field1\” \”field2\"”}
Otherwise Splunk will reply with:
{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}

If this help, please upvote. 

View solution in original post

ivanreis
Builder

Hi @teixeie , I was doing some research about it and I did not find any document or post that makes reference in how to scape those characters.
I found a document where they mentioned about this error "{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}  and how it can be fixed. The author is using the json format, and maybe it can be applied to your case, it is worth to try.

https://medium.com/adarma-tech-blog/splunk-http-event-collectors-explained-2c22e87ab8d2

Top Tips:

Double-quotes in the JSON Collector
When sending events that contain double-quotes (“”) or nested JSON structures, ie. a stream of text with JSON within “event” key, escape the double-quotes:
before: {“event”:”{“field1”:”value1"}”}
after: {“event”:”{\“field1\”:\”value1\"}”}
OR
before: {“event”:”[15/11/2019 11:00:00]“field1” ”field2"”}
after: {“event”:”[15/11/2019 11:00:00] \“field1\” \”field2\"”}
Otherwise Splunk will reply with:
{“text”:”Invalid data format”,”code”:6,”invalid-event-number”:0}

If this help, please upvote. 

teixeie
Engager

Thank you Ivanreis!

Escaping those characters indeed resolved the issue. I will add escaping for double quotes as well.

 

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...