topic Re: Sending Post to HEC (Splunk Cloud) not working in Getting Data In

Sending Post to HEC (Splunk Cloud) not working

codysysdig — Fri, 12 Jul 2019 14:58:55 GMT

Hi,

I've created my Data Input, enabled what needs to be enabled. The PUT works, and I get a Success response. However, when I try to search the activity logs using: source="http:", I get ZERO results.

curl -k :8088/services/collector -H "Authorization: Splunk XXXXXXXXXXXXXXXXX" -d '{"event": "hello world"}'

{"text":"Success","code":0}

Re: Sending Post to HEC (Splunk Cloud) not working

harsmarvania57 — Fri, 12 Jul 2019 15:11:18 GMT

What is the sourcetype you configured for HEC input ?

Re: Sending Post to HEC (Splunk Cloud) not working

codysysdig — Fri, 12 Jul 2019 15:46:28 GMT

At first, I did not select one. Then I set it to _json, either way, I dont get results back on the search.

Re: Sending Post to HEC (Splunk Cloud) not working

woodcock — Sat, 13 Jul 2019 22:18:18 GMT

Does the index value tied to your HEC token actually exist? Are you doing an All time search on your sourcetype (sometimes events get mis-timestamped and end up in the future or way in the past)?

Re: Sending Post to HEC (Splunk Cloud) not working

codysysdig — Mon, 15 Jul 2019 17:34:39 GMT

Yes, I've tried changing the time scale.

What I dont understand is why I can not see anything with source="http:inputname" but when I add index="summary", I can see my manual PUTs

Re: Sending Post to HEC (Splunk Cloud) not working

harsmarvania57 — Mon, 15 Jul 2019 17:41:36 GMT

Can you please change sourcetype from _json to json_no_timestamp and try again?

Re: Sending Post to HEC (Splunk Cloud) not working

woodcock — Mon, 15 Jul 2019 19:35:32 GMT

You should always ALWAYS specify input= in your search string. NEVER EVER rely on indexes searched by default because this can change arbitrarily at any moment. So if you are specifying index=summary in your HEC token definition and the events show up when you do index=summary then you actually do not have a problem. Is this your situation?

Re: Sending Post to HEC (Splunk Cloud) not working

dhihoriya_splun — Thu, 25 Jul 2019 04:55:38 GMT

Hi @codysysdig

If you are sending the events via HEC curl then you can search the events from that particular HEC token via:

Query:
source="http:https input name"

Example:
If you have created HEC token with name "test123" and you are sending any event via mentioning the token ID in curl command then you can search event for test123 via :

source="http:test123"

Thanks,
Dixit