topic Re: Splunk HEC response time in Getting Data In

Splunk HEC response time

lufermalgo — Tue, 03 Sep 2019 16:43:36 GMT

Hello community, how can I build a report that allows me to know what the response time it takes for requests via HTTP Events Collector.

Re: Splunk HEC response time

Vijeta — Tue, 03 Sep 2019 18:38:36 GMT

@lufermalgo :- you can look for _indextime of your logs coming from HTTP event collector and compare with the timestamp in logs. The difference will be the response time between logs sent from source and indexed at Splunk.

Re: Splunk HEC response time

lufermalgo — Wed, 04 Sep 2019 20:25:58 GMT

thank you @Vijeta for you answer,

Based on your input, should I assume that an HEC request is not released until the event is written in the index?

I usually use that indicator to identify if there is a delay in writing the event in the indexes, but I'm not sure if I can also assume that it would be the response time of HEC.

Thank you.

Re: Splunk HEC response time

Vijeta — Wed, 04 Sep 2019 20:39:35 GMT

What is meant by HEC response time here? The time HEC event is released from source and reaches Splunk HEC instance or Splunk indexer. The time between HEC instance(HF) to indexer would be very very small rather instant, so I would consider response time as time when event was indexed and time when event was released from the actual source.

Re: Splunk HEC response time

masonmorales — Wed, 04 Sep 2019 20:49:43 GMT

Response time would have to be measured from the client side. The metrics that Splunk has available for HEC performance can be found at: https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector

Re: Splunk HEC response time

lufermalgo — Wed, 04 Sep 2019 22:01:32 GMT

Thank you @masonmo for you answer,

It is correct, we have the measurement and it gives us that the average is 800ms which is very high, I don't know if it is because the Splunk Cloud instance is in Brazil.

I just wanted to know if it is possible to make that measurement also on the Splunk side.

Thank you