I'm using telegraf to query splunk API to gather some internal metrics. When I run via curl or python http requests lib I have no issue, however with my telegraf config I always receive a 400 response.

telegraf.conf

[[inputs.http]]
     urls = ["https:<splunk_api_endpoint>/services/search/v2/jobs/export"]
     data_format = "json"
     method = "POST"
     body = '{"search": "| inputlookup custom.csv", "output_mode": "json"}'
     response_timeout = "30s"
     success_status_codes = [200]

I'm unsure of how to debug further, using telegraf --debug and --test flags only show that the response received is a 400 error.

I noticed with curl that the content type being set is application/x-www-form-urlencoded. Even when I set that header in the telegraf config I still receive the same 400.

My only guess is that something unknown is happening to the request body. Perhaps digging into splunk request logs might yield some interesting information but I'm curious if anyone has any insight here.

I have truncated the above telegraf.conf. I have set appropriate values for inputs.http.json etcetera. I am also able to hit other endpoints that utilize GET without any issues

I'm using telegraf to query splunk API to gather some internal metrics. When I run via curl or python http requests lib I have no issue, however with my telegraf config I always receive a 400 response.

telegraf.conf

[[inputs.http]]
     urls = ["https:<splunk_api_endpoint>/services/search/v2/jobs/export"]
     data_format = "json"
     method = "POST"
     body = '{"search": "| inputlookup custom.csv", "output_mode": "json"}'
     response_timeout = "30s"
     success_status_codes = [200]

I'm unsure of how to debug further, using telegraf --debug and --test flags only show that the response received is a 400 error.

I noticed with curl that the content type being set is application/x-www-form-urlencoded. Even when I set that header in the telegraf config I still receive the same 400.

My only guess is that something unknown is happening to the request body. Perhaps digging into splunk request logs might yield some interesting information but I'm curious if anyone has any insight here.

I have truncated the above telegraf.conf. I have set appropriate values for inputs.http.json etcetera. I am also able to hit other endpoints that utilize GET without any issues

• telegraf
• telegraf-inputs-plugin

1 Answer 1

the request returns 200 with body = "search=| inputlookup custom.csv&output_mode=json"

Splunk API is expecting a url query string for the body payload.