topic Re: Zero bytes in the indexed events in Getting Data In

Zero bytes in the indexed events

swlf — Fri, 21 Feb 2025 19:47:52 GMT

Hi! This is my first time using Splunk and I am on the free tiral version. I setup an HEC token and ran a test on Windows following this command:

curl -k https://prd-p-n38b3.splunkcloud.com:8088/services/collector -H "Authorization: Splunk 78c2aexx-xxxx-xxxxx-xxxx-xxxxx869e53" -d "{\"sourcetype\": \"event\", \"event\": \"Test message\"}"

While the events are being generated, I see 0 bytes. What am I doing wrong?

I also see the events in the HEC logs but no data.

Re: Zero bytes in the indexed events

livehybrid — Fri, 21 Feb 2025 22:03:02 GMT

Hi @swlf

Whilst its showing as 0 bytes, it does show that there are 11 events in your index?

Try doing a search for all-time on that index (since there is only 11 events) to confirm if this is/isnt the data you are expecting? It could be that the 0 Bytes shown just a rounding error given the small number of events!

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: Zero bytes in the indexed events

swlf — Fri, 21 Feb 2025 23:48:25 GMT

@livehybrid this instance of Splunk Cloud was created yesterday. So all the events are new and from my test. My search is set to last 7 days by default.

But none of the events have the data. If you see the raw event details in my second screenshot, it shows the format "json" but not the raw data.

Am I looking in the right place?

Re: Zero bytes in the indexed events

swlf — Sat, 22 Feb 2025 00:48:54 GMT

I think there is an indexing delay in Splunk. I first index now shows the number of bytes indexed. But I still don't know where to find the raw data. I've been navigating to the HEC page and clicking on the host which shows all the logs but not the raw data.

Re: Zero bytes in the indexed events

kiran_panchavat — Sat, 22 Feb 2025 05:01:26 GMT

@swlf

HEC receives events via HTTP requests that may include a HEC token, channel identifier header, metadata, or event data formatted as raw text or JSON.

https://docs.splunk.com/Documentation/Splunk/9.4.0/Data/FormateventsforHTTPEventCollector

The raw JSON is still stored in the _raw field. Try running a search like:

Or, once you run the query you change your view from "List" to "Raw"

Re: Zero bytes in the indexed events

swlf — Sat, 22 Feb 2025 05:40:12 GMT

@kiran_panchavat thank you! I followed the format of your search query and now I can see the data. Really appreciate your response and the education.