Archive

Splunk HEC response time

Path Finder

Hello community, how can I build a report that allows me to know what the response time it takes for requests via HTTP Events Collector.

0 Karma
1 Solution

Influencer

Response time would have to be measured from the client side. The metrics that Splunk has available for HEC performance can be found at: https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector

View solution in original post

0 Karma

Influencer

Response time would have to be measured from the client side. The metrics that Splunk has available for HEC performance can be found at: https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector

View solution in original post

0 Karma

Path Finder

Thank you @masonmo for you answer,

It is correct, we have the measurement and it gives us that the average is 800ms which is very high, I don't know if it is because the Splunk Cloud instance is in Brazil.

I just wanted to know if it is possible to make that measurement also on the Splunk side.

Thank you

0 Karma

Influencer

@lufermalgo :- you can look for _indextime of your logs coming from HTTP event collector and compare with the timestamp in logs. The difference will be the response time between logs sent from source and indexed at Splunk.

0 Karma

Path Finder

thank you @Vijeta for you answer,

Based on your input, should I assume that an HEC request is not released until the event is written in the index?

I usually use that indicator to identify if there is a delay in writing the event in the indexes, but I'm not sure if I can also assume that it would be the response time of HEC.

Thank you.

0 Karma

Influencer

What is meant by HEC response time here? The time HEC event is released from source and reaches Splunk HEC instance or Splunk indexer. The time between HEC instance(HF) to indexer would be very very small rather instant, so I would consider response time as time when event was indexed and time when event was released from the actual source.

0 Karma