Getting Data In

Can not find HTTP Event Collector field events

fmathis
Engager

Hello,

I am trying to post events through HEC like so :

{
  "host": "my_host",
  "sourcetype": "my_source_type",
  "time": 15617254748.888,
  "event": {
    "event": "my_event_name",
    "source": "my_source",
    "message": "My message"
  }
}

Unfortunately, I cannot find these events in my index, and this seems to be due to the presence of the inner field event.

Is there a way to pass the event name inside the event object?

0 Karma
1 Solution

renjith_nair
Legend

@fmathis ,
It depends on your implementation but I was able to send a json with event in the message programmatically as well as using simple curl.

curl -k -H "Authorization: Splunk my_splunk_token" https://my_splunk_host:hec_port/services/collector/event -d '{"sourcetype": "_json", "event": "{\"event\":\"my_event\",\"message\":\"This message has event name\"}"}'

Result
alt text

From your event above, looks like the timestamp is a future one. You may try searching the default index configured with the token and also probably for "All Time"

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@fmathis ,
It depends on your implementation but I was able to send a json with event in the message programmatically as well as using simple curl.

curl -k -H "Authorization: Splunk my_splunk_token" https://my_splunk_host:hec_port/services/collector/event -d '{"sourcetype": "_json", "event": "{\"event\":\"my_event\",\"message\":\"This message has event name\"}"}'

Result
alt text

From your event above, looks like the timestamp is a future one. You may try searching the default index configured with the token and also probably for "All Time"

---
What goes around comes around. If it helps, hit it with Karma 🙂

fmathis
Engager

Thanks a lot for your answer, I must have been fooled by the timestamp !
The thing is, I could never find an exemple of sending an event field inside the event object, so I started doubting that might be possible.
Thanks again !

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...