topic Re: HTTP Event Collector do not completly index data in Getting Data In

HTTP Event Collector do not completly index data

nanapark — Mon, 25 Jun 2018 10:53:12 GMT

While trying to index data using the HTTP Event Collector, I got some data loss, especially in the last row.
Data format used is the following:

Multiple lines separated by CRLF
encode UTF-8
Data's format : flat JSON

Example:
{"field1":1,"field2":2,"field3":"smth"} CRLF
{"field1":2,"field2":3,"field3":"smth"} CRLF
{"field1":3,"field2":4,"field3":"smth"}

Anyone have an idea about this problem?

Re: HTTP Event Collector do not completly index data

amiftah — Mon, 25 Jun 2018 12:46:19 GMT

Can you show your sourcetype in props.conf ?

Re: HTTP Event Collector do not completly index data

nanapark — Tue, 26 Jun 2018 13:28:29 GMT

Unfortunately, I do not have access to the props.conf
We found that special characters are making trouble for the HEC such as: double quotes “ or é or è ...
Is there any solution to let the HEC accept those characters?

Re: HTTP Event Collector do not completly index data

nanapark — Tue, 26 Jun 2018 13:40:09 GMT

I don't know if this can help. In indexed data I found this : sourcetype = _json

Re: HTTP Event Collector do not completly index data

amiftah — Tue, 26 Jun 2018 17:36:16 GMT

Which Splunk version are you using?

Re: HTTP Event Collector do not completly index data

nanapark — Wed, 27 Jun 2018 07:47:20 GMT

we are using splunk 6.5.3