HEC event field

Haleb — Thu, 02 May 2024 10:21:58 GMT

I need to connect data from a third party application via HEC to Splunk. It sends data in this format 1 event per request:

{ "field1":"value", "field2":"value" }

After looking at the documentation for HEC, I discovered that for events to work correctly, they must have the following format:

{ "event":{ "field1":"value", "field2":"value" } }

Otherwise I receive an error:

{"text":"No data","code":5}

I don't have the ability to change the event format on the third-party application side. How can this problem be solved?

Re: HEC event field

richgalloway — Thu, 02 May 2024 12:21:02 GMT

There are several ways to send data to HEC and not all of them use that format. The raw endpoint should accept events in your desired format. See https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/FormateventsforHTTPEventCollector#Format_events_for_HTTP_Event_Collector