topic I can see data in logs but not in index for http event collector in Splunk Dev

I can see data in logs but not in index for http event collector

Amandeepsin — Tue, 29 Sep 2020 19:30:05 GMT

I can see http_event_collector_metrics.log logs under

$SPLUNK_HOME/var/log/introspection/splunk/

But splunk says latest event received was 2 days ago. Whats going wrong in http event collector as I cannot see data if I select index after 7th of may. Previous data is available

Re: I can see data in logs but not in index for http event collector

PowerPacked — Wed, 09 May 2018 21:36:16 GMT

Hi @Amandeepsin

The _introspection index data is splunk's internal metrics regarding HEC performance and connection.

You need to check the own index into which the data is coming in.

Here is the sample event.

Thanks

Re: I can see data in logs but not in index for http event collector

Amandeepsin — Thu, 10 May 2018 04:55:51 GMT

Hi,

Latest event to that own index which is mentioned in HEC source is 2 days ago. But in _introspection I can see events.

Any comments!!

Thanks,