topic Re: Why events is not broken down correctly in HEC raw mode? in Getting Data In

Why events is not broken down correctly in HEC raw mode?

wcui_splunk — Fri, 14 Apr 2017 07:30:38 GMT

Hi, I'm investigating to use HEC raw mode to index some data. In my case I want to stream the data with multiple HTTP requests with a fixed channel ID, because the client never changed. My splunk server version is 6.4.3.

I'm using the bellow python code to test the HEC behavior, and result is the same as using cURL or postman.
#!/usr/bin/env python

import requests
import uuid
import time

data = "2017-01-01T12:00:00Z, a=b\n2017-01-01T12:00:01Z, b=c\n"
headers = {"Authorization" : "Splunk EB49F64A-6487-4F87-8EFF-3209CD22CC50"}
params = {"sourcetype":"pythontest", "source": "pythontest2"}

def sendInSession():
       params.update({"channel": str(uuid.uuid4()).upper()})
       r = requests.Request('POST', 'https://dbx.splunk.dev:8088/services/collector/raw', data=data, params=params, headers=headers)

       with requests.Session() as s:
            r_p = s.prepare_request(r)
            print s.send(r_p, verify=False).content
            time.sleep(3)

            print s.send(r_p, verify=False).content
            time.sleep(3)

I'm using session here to reuse the same connection, and two HTTP requests were made to splunkd. Looks like the data was correctly indexed for the first request, while the events of second request were not broken up correctly.

You can see the result here:

My question is:
Why the same data results different fields breaking result in splunk if using the same channel ID?

Re: Why events is not broken down correctly in HEC raw mode?

starcher — Fri, 14 Apr 2017 15:40:35 GMT

In raw mode all event breaking is going to happen at the HF receiving it. You might want to trouble shoot there especially if you are batching the data. You could also use my python class which has this threaded.
https://github.com/georgestarcher/Splunk-Class-httpevent

Re: Why events is not broken down correctly in HEC raw mode?

yannK — Mon, 17 Apr 2017 18:11:42 GMT

Try to setup a strict parsing rule for linebreaking for the sourcetype "pythontest"
on the indexers (or heavy forwarders)

Re: Why events is not broken down correctly in HEC raw mode?

wcui_splunk — Tue, 18 Apr 2017 01:38:42 GMT

Thank you. I think it's probably not the root cause, otherwise the event can not be broken correctly at first.
And my testing shows:
1) If I change the channel id for every HTTP request, then line breaking works correctly.
2) This code just works for 6.5.3, so maybe it's a bug in 6.4.3. Anyone can confirm?

Re: Why events is not broken down correctly in HEC raw mode?

ybongart_splunk — Fri, 24 Nov 2017 14:33:16 GMT

I was not able to reproduce this in v7 either.

Re: Why events is not broken down correctly in HEC raw mode?

fabiocaldas — Wed, 21 Feb 2018 23:12:37 GMT

I'm using Splunk7 and I'm also having this problem