We are populating Splunk using an HEC connection with a source type of _json, set to the default character set of UTF-8.  However, a field shown in the raw data as: "Character test: 0242 (\\u00f2): >\uC3B2<" is displayed as: Character test: 0242 (\u00f2): >쎲< I would have expected the display to show the character, ò, which is the UTF-8 equivalent of hexadecimal C3B2, rather than the displayed UNICODE character ... View more

I am attempting to use an HEC with basic authentication via HTTPS, but receiving a response 403 "Forbidden" when using the authorization header as Base64 encoded username:password pair.  The username:HEC token works as is hinted in the documentation, so my question is whether there is any way to use a user's password for authentication, or a session key from a login request, when posting data to an HEC.   If not, are there any endpoints that will return a response on an HTTP request? Thanks in advance for any advice you can give.   ... View more

I'm trying to post REST data via HTTP to splunk.  This works when using a pre-generated token to an HEC: POST /services/collector/event HTTP/1.0\r\nHost: galaxy.xypro.com\r\nContent-Type: application/json\r\nKeep-Alive: 100\r\nConnection: keep-alive\r\nAuthorization: Splunk 1d07454b-d9ef-41b0-9450-59d8670a78c7\r\nContent-Length: 166\r\n\r\n{\"time\": 1636117458, \"host\": \"galaxy.xypro.com\", \"source\": \"test\", \"event\": { \"message\": \"2021-11-05:13:04:18.491986: Logging test message #0\", \"severity\": \"INFO\" } } HTTP/1.1 200 OK\r\nDate: Fri, 05 Nov 2021 20:05:17 GMT\r\nContent-Type: application/json; charset=UTF-8\r\nX-Content-Type-Options: nosniff\r\nContent-Length: 27\r\nVary: Authorization\r\nConnection: Keep-Alive\r\nX-Frame-Options: SAMEORIGIN\r\nServer: Splunkd\r\n\r\n{\"text\":\"Success\",\"code\":0} However, when I try to generate a session token to allow basic authorization, I see the following response, even though the user and password are correct: POST HTTPS://localhost:8089/services/auth/login HTTP/1.0\r\nHost: galaxy.xypro.com\r\nContent-Type: application/json\r\nKeep-Alive: 100\r\nConnection: keep-alive\r\nAuthorization: Basic a3B3YXRlcnNvbjpUZXN0MTIzNDU=\r\nContent-Length: 48\r\n\r\n{\"username\":\"kpwaterson\",\"password\":\"Test12345\"} HTTP/1.1 400 Bad Request\r\nDate: Fri, 05 Nov 2021 19:57:40 GMT\r\nExpires: Thu, 26 Oct 1978 00:00:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, max-age=0\r\nContent-Type: text/xml; charset=UTF-8\r\nX-Content-Type-Options: nosniff\r\nContent-Length: 129\r\nConnection: Keep-Alive\r\nX-Frame-Options: SAMEORIGIN\r\nServer: Splunkd\r\n\r\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<response>\n <messages>\n <msg type=\"WARN\">Login failed</msg>\n </messages>\n</response>\n I was also investigating using receivers\simple for http messages.  Although the message is posted to splunk, a response is never received. POST /services/receivers/simple?source=NonStop&index=main&sourcetype=json_no_timestamp HTTP/1.0\r\nHost: galaxy.xypro.com\r\nContent-Type: application/json\r\nKeep-Alive: 100\r\nConnection: keep-alive\r\nAuthorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnIjoiSFM1MTIiLCJ2ZXIiOiJ2MiIsInR0eXAiOiJzdGF0aWMifQ.eyJpc3MiOiJrZW4ud2F0ZXJzb24gZnJvbSBWTS1ERVYtU1BMVU5LIiwic3ViIjoia2VuLndhdGVyc29uIiwiYXVkIjoiRGV2ZWxvcG1lbnQiLCJpZHAiOiJMREFQOi8vbWZhIiwianRpIjoiODUzMDYyZmFhZjA0NWY0Y2JlMWEyNGMxZWE3NTAyYjRmMjEwMGEyNzE0NzA1N2Q0MmUxOGVkYWRlMTYyZTlkZiIsImlhdCI6MTYzMzUyNTE5MywiZXhwIjoxNjM2MTE3MTkzLCJuYnIiOjE2MzM1MjUxOTN9.3TKSCeK52awMJDxNzfvfW4PNewsGVlKkFXSf0Vy1Dv7JH4DNH9Ogn_w5WZLkZkeNXmjJqU8opORXW7DjxA2eag\r\nContent-Length: 166\r\n\r\n{\"time\": 1636117714, \"host\":\"galaxy.xypro.com\", \"source\": \"test\", \"event\": { \"message\": \"2021-11-05:13:08:34.900042: Logging test message #0\", \"severity\": \"INFO\" } } Could you please let me know what may be the issue with generating the session key and why a response is not received from receivers/simple?  Thanks.           ... View more