Httpjson Input

I am configuring an HTTPJSON Input from Fleet using the UI and doing a POST on a REST endpoint. I need to send a body in the request. The documentation isn't too clear about the format it should be in inside the request body field in the UI. The name/value fields I need to submit in the HTTPJSON request body from the UI are:

search=search index=phantom_container earliest=-7d | head 100 | addinfo 

The endpoint the HTTPJSON Input hits is Splunk's search API and I am trying to ingest the JSON response from the Splunk search in Elasticsearch

Thanks for your help.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.