Fields not recognized in Events from HTTP Event Collector (HEC)

jfrankman — Wed, 30 Aug 2023 19:43:41 GMT

We are noticing that that same data received via the HTTP Event Collector is not searchable by Field like data received via our Forwarders.

Note how EventName field IS NOT being picked up from Event received through HEC:

Note how EventName IS getting picked up from Event received through Forwarders:

It seems that the events received through the HEC are treated as one large Blob of data and are not parsed or indexed the same way by Splunk. I there anything that can be done in the request to the HEC or to an indexer to resolve this?

Thanks.

topic Fields not recognized in Events from HTTP Event Collector (HEC) in Getting Data In

Fields not recognized in Events from HTTP Event Collector (HEC)