topic Re: INGEST_EVAL for data coming from HEC at indexer layer in Getting Data In

INGEST_EVAL for data coming from HEC at indexer layer

cafissimo — Tue, 20 Feb 2024 21:46:26 GMT

Hello,

Please, in Splunk Enterprise, I would like to know if it is possible to apply an INGEST_EVAL processing at indexer layer for data that is coming to indexer from a HEC (http event collector).

Thanks

Re: INGEST_EVAL for data coming from HEC at indexer layer

isoutamo — Tue, 20 Feb 2024 22:29:14 GMT

as transforms are handled on typing processor based on this picture https://www.aplura.com/assets/pdf/hec_pipelines.pdf it’s doable.

r. Ismo

Re: INGEST_EVAL for data coming from HEC at indexer layer

PickleRick — Tue, 20 Feb 2024 22:52:58 GMT

Yep. +1 on that. HEC does skip some parts of the pipeline (line breaking, often timestamp recognition) but the index-time extractions and evals are applied normally.