topic Re: How can we find out which HTTP Event Collector tokens are not being used? in Getting Data In

How can we find out which HTTP Event Collector tokens are not being used?

ddrillic — Fri, 18 Jan 2019 16:07:34 GMT

We have numerous input stanzas like -

[http://<name>]
disabled = 0
token = xxxxxxxx-xxxx-xxxxx-xxxx-xxxxxxxxxxxxx
index = <index name>
indexes = <index name>
queueSize = 100MB
useACK = 0
sourcetype = json

As time passes by, we have more and more stale connections. Can we find out which tokens are stale and not being used?

Re: How can we find out which HTTP Event Collector tokens are not being used?

harsmarvania57 — Fri, 18 Jan 2019 16:42:02 GMT

Hi,

You can check which HEC token is in use in _introspection Index with below query.

index=_introspection host=YOUR_HEC_HOST  sourcetype=http_event_collector_metrics data.token_name=*
| rename data.* as *
| table host, component, token_name, num_*

If there will be 0 num_of_requests or num_of_events for longer time span then I guess you can disable those token for few days and then remove it.

Re: How can we find out which HTTP Event Collector tokens are not being used?

ddrillic — Sat, 26 Jan 2019 23:07:21 GMT

Gorgeous @ harsmarvania57.

Re: How can we find out which HTTP Event Collector tokens are not being used?

sowmya_prasanna — Wed, 03 Jul 2019 06:17:01 GMT

how can we pull same information using rest API call?