Sending data to Splunk using HEC

deepasha1989 — Mon, 19 Jul 2021 11:48:41 GMT

I am sending data to Splunk using HEC but after trying all the methods exposed by Splunk API , I am getting all the custom properties nested under a single "message" or "data" attribute. Is there a way so that all my properties are logged in original format and not under a single head.

Actual : { ID: 123,

message: src : "abcd", category: "list" , user: "tchsavy"

}

Expected : { ID : 123 ,

message : "Hello" ,

src : "abcd",

category: "list" ,

user: "tchsavy" }

Re: Sending data to Splunk using HEC

venkatasri — Mon, 19 Jul 2021 21:07:40 GMT

Hi @deepasha1989

Splunk HEC is one of the interface to ingest logs to Splunk. Having said that it doesn't do any pre-process of payload that you send. What you send via HEC is exactly what you will find in Splunk search.

If you want in a format that you are expecting you shall pre-process payload the format you want and send it.

Other approach is to ingest the original payload with single attribute message: , data: etc and post-process it during the search-time. However that would be a complex process and extra overhead in Search UI depends on size of payload and logic that you will apply, you can test upfront in search UI using | makeresults command if the logic you intent to write really works then decide.

---

An upvote would be appreciated and Accept solution if this reply helps!

topic Re: Sending data to Splunk using HEC in Getting Data In

Sending data to Splunk using HEC

Re: Sending data to Splunk using HEC