topic Re: Where does the HEC data gets stored ? in Getting Data In

Where does the HEC data gets stored ?

surekhasplunk — Fri, 03 Jul 2020 03:28:55 GMT

I have HTTP event collector well configured using token from a client.

Now i want to understand where does these json format events gets stored?

I mean the exact json logs which are coming via HEC, are they stored somewhere in our splunk environment ?

Re: Where does the HEC data gets stored ?

isoutamo — Fri, 03 Jul 2020 04:43:30 GMT

Usually in inputs.conf there are definitions under every input stanza in which indexes events can and/or must stored.

r. Ismo

Re: Where does the HEC data gets stored ?

ak9092 — Fri, 03 Jul 2020 08:06:07 GMT

@surekhasplunk if you're asking if some file is created in Splunk environment before indexing the events coming over HEC, then that's not the case as i believe HTTP events directly gets indexed to the specified index name in the input stanza.

Re: Where does the HEC data gets stored ?

isoutamo — Fri, 03 Jul 2020 10:57:34 GMT

the one can also define used (or want to use) index on HEC json.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/FormateventsforHTTPEventCollector

For that reason it's good to define allowed / used index on inputs.conf per used token.

And of course the one must first define used indexes on indexers otherwise events goes to the last change index which is usually main-index.

r. Ismo

Re: Where does the HEC data gets stored ?

richgalloway — Fri, 03 Jul 2020 13:14:11 GMT

HEC stores data in your Splunk indexes.