Getting Data In

Fields not recognized in Events from HTTP Event Collector (HEC)

jfrankman
Loves-to-Learn Lots

We are noticing that that same data received via the HTTP Event Collector is not searchable by Field like data received via our Forwarders.

Note how EventName field IS NOT being picked up from Event received through HEC:

jfrankman_1-1693424382299.png

 

Note how EventName IS getting picked up from Event received through Forwarders:

jfrankman_0-1693424317126.png

 

It seems that the events received through the HEC are treated as one large Blob of data and are not parsed or indexed the same way by Splunk. I there anything that can be done in the request to the HEC or to an indexer to resolve this?

Thanks.

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...