SPLK-1003 · Question #140
What is the correct curl to send multiple events through HTTP Event Collector?
The correct answer is B. Option B. When sending multiple events to Splunk's HTTP Event Collector (HEC), each event must be a separate JSON object concatenated sequentially in a single POST body, not wrapped in a JSON array. Option B demonstrates this correct format.
Question
What is the correct curl to send multiple events through HTTP Event Collector?
Exhibit
Options
- AOption A
- BOption B
- COption C
- DOption D
How the community answered
(29 responses)- A7% (2)
- B90% (26)
- C3% (1)
Why each option
When sending multiple events to Splunk's HTTP Event Collector (HEC), each event must be a separate JSON object concatenated sequentially in a single POST body, not wrapped in a JSON array. Option B demonstrates this correct format.
This option likely wraps the events inside a JSON array, which HEC does not support and will cause the entire payload to be rejected or misprocessed as a single malformed event.
HEC accepts multiple events in a single HTTP request by concatenating individual JSON event objects one after another with no commas or enclosing array brackets, where each object carries its own 'event' key. This raw-concatenation format allows HEC to parse and index each event independently, and must be combined with the correct Authorization header using the HEC token.
This option likely uses an incorrect API endpoint, missing or malformed Authorization header, or wrong Content-Type that prevents HEC from accepting the request.
This option likely uses incorrect JSON structure or omits required fields such as the 'event' key, causing HEC to return an error and fail to index the data.
Concept tested: HTTP Event Collector multi-event curl request format
Source: https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector
Topics
Community Discussion
No community discussion yet for this question.