topic Sending logs using Splunk HEC in Getting Data In

Sending logs using Splunk HEC

cyber_castle — Thu, 10 Oct 2019 09:37:44 GMT

Hello,

We have a requirement to send the logs from one of our IoT devices in to the Splunk. As it doesnt have syslog functionality/ install splunk agent, we are planning to use HEC.

I have gone through the Splunk documentation on HEC and created the token and did some testing using curl and everything looks good. (curl -k http://localhost:8088/services/collector -H "Authorization:Splunk " -d "{json formatted entries}").

Now what should be the next step to collect the actual logs from the device. Whether the developer needs to output the logs in to the above Splunk HEC token?

Re: Sending logs using Splunk HEC

Prewin027 — Mon, 14 Oct 2019 05:08:21 GMT

Hi,

Yes. Now using created HEC Token you can use your application to send data to Splunk HEC.

There are several options for sending data to HTTP Event Collector:

You can make an HTTP request using your favorite HTTP client and send your JSON-encoded events.
As a developer, you can use the Java, JavaScript (node.js), and .NET logging libraries in your application to send data to HEC. These libraries are compatible with popular logging frameworks.

http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE2K

http://dev.splunk.com/view/splunk-loglib-dotnet/SP-CAAAEX4