topic Re: HTTP Event Collector -- How to specify folder or path name to store logs on heavy forwarder before being sent to indexer? in Getting Data In

HTTP Event Collector -- How to specify folder or path name to store logs on heavy forwarder before being sent to indexer?

siva_cg — Fri, 20 Oct 2017 14:23:18 GMT

Hi All,

Could you please help me with the query regarding collecting data using the HTTP Event Collector? I am trying to collect logs from F5 appliances using HEC method. The basic architecture will look like below:

F5 appliances ----> Load Balancer ----> Heavy Forwarder (where HEC will be configured) ----> Indexers

Now, my query exactly is, how to specify folder or path name to store logs on Heavy forwarder before being sent to Indexers? Any documentation or help is much appreciated.

Thanks in advance.

Re: HTTP Event Collector -- How to specify folder or path name to store logs on heavy forwarder before being sent to indexer?

starcher — Fri, 20 Oct 2017 18:41:10 GMT

HEC doesn't store files on disk. You should have the HF setup to receive HEC and have an appropriate outputs to point to your indexing layer.

http://dev.splunk.com/view/event-collector/SP-CAAAE6M

http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/UsetheHTTPEventCollector

Re: HTTP Event Collector -- How to specify folder or path name to store logs on heavy forwarder before being sent to indexer?

siva_cg — Tue, 29 Sep 2020 16:23:15 GMT

Hi @starcher,

Thank you for providing me the document links. So a typical configuration looks like as below:

in the splunk_httpinput app,
[http://F5_Analytics]
description = Token to get the logs from F5 iApp
disabled = 0
index = f5_ltm
sourcetype = f5_iapp_logs
token = xxxxxxxxxx
outoputgroup = f5

and use this outputgroup in outputs.conf of HF. Please correct me if I am wrong.

Thanks in advance.

Re: HTTP Event Collector -- How to specify folder or path name to store logs on heavy forwarder before being sent to indexer?

nickhills — Mon, 23 Oct 2017 10:51:36 GMT

That's correct!

Re: HTTP Event Collector -- How to specify folder or path name to store logs on heavy forwarder before being sent to indexer?

siva_cg — Mon, 23 Oct 2017 10:55:47 GMT

Thank you very much @nickhillscpl.