Here are three cURL command line examples for interacting with a Splunk instance: sending event data, sending metrics data, and querying a Splunk index.

1. Send Event Data to a Splunk Index

You can send raw event data to a Splunk HTTP Event Collector (HEC) using a POST request.

curl -k https://<SPLUNK_SERVER>:8088/services/collector/event \
     -H "Authorization: Splunk <HEC_TOKEN>" \
     -d '{"event": "User logged in", "sourcetype": "manual_event", "index": "<INDEX_NAME>"}'

• : Replace with your Splunk server's address.
• : Replace with your HTTP Event Collector (HEC) token.
• : Replace with the index name where you want to store the event.
• "event": The data you want to send to Splunk.

2. Send Metrics Data to a Splunk Index

To send metrics data (e.g., CPU usage, memory consumption) to a Splunk metrics index, use a similar cURL command but include metrics-specific fields.

curl -k https://<SPLUNK_SERVER>:8088/services/collector \
     -H "Authorization: Splunk <HEC_TOKEN>" \
     -d '{"time": 1609459200, "event": "metric", "fields": {"_value": 70}, "sourcetype": "_json", "index": "<INDEX_NAME>", "metric_name": "cpu_usage"}'

• "event": "metric": Indicates that this is a metrics event.
• "fields": The _value field represents the metric value, and metric_name is the name of the metric being recorded.
• "time": (Optional) Unix timestamp for the event.

3. Query a Splunk Index

To query a Splunk index using cURL, use the /services/search/jobs endpoint to start a search and then retrieve the results.

Step 1: Create a Search Job

curl -k https://<SPLUNK_SERVER>:8089/services/search/jobs \
     -u <USERNAME>:<PASSWORD> \
     -d search="search index=<INDEX_NAME> sourcetype=<SOURCETYPE> | head 10"

• and : Replace with your Splunk credentials.
• : The index you want to query.
• : Optional, to narrow down by sourcetype.

This will return a sid (search ID) that you will use in the next step.

Step 2: Retrieve the Search Results

curl -k https://<SPLUNK_SERVER>:8089/services/search/jobs/<SEARCH_ID>/results \
     -u <USERNAME>:<PASSWORD>

• : Replace with the sid returned from the previous command.
• This will return the search results in XML or JSON format (depending on your Splunk configuration).

Summary:

• Send Event Data: Use the /services/collector/event endpoint.
• Send Metrics Data: Use the /services/collector endpoint with metric-specific fields.
• Query Data: Create a search job with /services/search/jobs and retrieve the results using the job’s sid.