Why are HTTP Event Collector events not appearing the index?

NickLaurent — Fri, 28 Apr 2017 00:59:32 GMT

Hello fellow Splunkers,
I need some help with HEC (HTTP Event Collector). The problem is that no events are appearing in any indexes. To simplify the issue I set up a test HEC config without SSL (http). I use the curl command with an event "Hello World!" I get a status 200 successful. Let nothing in the indexes.
Environment:
Windows 10, with Splunk Enterprise:
HEC, three unique Tokens with same Sourcetypes, different indexes.

1 Arduino setup to sent events via HEC
1 PI setup to send events via HEC
1 MAC for testing HEC using a curl command.

Thanks

Nick

Re: Why are HTTP Event Collector events not appearing the index?

starcher — Fri, 29 Sep 2017 16:35:23 GMT

You will have to find someone's code or write your own for Arduino. But on a PI/Mac you can use Python and here is an existing HEC class for it. https://github.com/georgestarcher/Splunk-Class-httpevent

topic Re: Why are HTTP Event Collector events not appearing the index? in Getting Data In

Why are HTTP Event Collector events not appearing the index?

Re: Why are HTTP Event Collector events not appearing the index?