topic Re: Events missing via http event collector in Getting Data In

Events missing via http event collector

phagunbaya — Wed, 23 Dec 2015 16:45:27 GMT

I'm seeing a behaviour where some of my events are missing after been sent to http event collector. I'm sending single event per request. Sometimes it shows all the events and sometimes it does not. Normally it happens if the frequency is high (4-5 events per second).

Re: Events missing via http event collector

jplumsdaine22 — Wed, 30 Dec 2015 14:52:08 GMT

Are you getting a response from the indexer every time that the event was collected?

Re: Events missing via http event collector

jkat54 — Wed, 30 Dec 2015 19:07:23 GMT

This is a good point from jplumsdaine22... Do you confirm a 200 response and if not retry / fall back into an exception that can be handled?

Re: Events missing via http event collector

phagunbaya — Fri, 08 Jan 2016 15:19:49 GMT

Yes. response was 200.

Re: Events missing via http event collector

gblock_splunk — Sun, 14 Feb 2016 05:16:35 GMT

4 - 5 events per second is not high, we've designed HEC to support 100K a second on a single instance 🙂

How big are the events?
Are you getting a 200 OK response consistently?
What is your configuration? Are you sending directly to HEC running on an indexer, or are you hosting HEC on a heavyweight forwarder and forwarding to the indexer?

Re: Events missing via http event collector

netrc — Wed, 24 Feb 2016 20:06:52 GMT

I've seen HEC drop data with small events (100 bytes), sent 4-5/sec, for just a couple seconds (all just for testing). Each POST returns status 200 (OK). Tried this with both bash script using curl and also nodeJS; direct from the script to the HEC on the indexer. (Yes, the indexer is a little busy with other work). Over a couple hundred events, I've seen only 50% get stored.

But I'd think that getting a 200 (OK) would mean that the data is stored for sure in Splunk.

Re: Events missing via http event collector

splunker_2016_N — Thu, 17 Nov 2016 15:16:56 GMT

did this get fixed , even im missing a few events while running from java aws lambda