Getting Data In

Can not find HTTP Event Collector field events

Engager

Hello,

I am trying to post events through HEC like so :

{
  "host": "my_host",
  "sourcetype": "my_source_type",
  "time": 15617254748.888,
  "event": {
    "event": "my_event_name",
    "source": "my_source",
    "message": "My message"
  }
}

Unfortunately, I cannot find these events in my index, and this seems to be due to the presence of the inner field event.

Is there a way to pass the event name inside the event object?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@fmathis ,
It depends on your implementation but I was able to send a json with event in the message programmatically as well as using simple curl.

curl -k -H "Authorization: Splunk my_splunk_token" https://my_splunk_host:hec_port/services/collector/event -d '{"sourcetype": "_json", "event": "{\"event\":\"my_event\",\"message\":\"This message has event name\"}"}'

Result
alt text

From your event above, looks like the timestamp is a future one. You may try searching the default index configured with the token and also probably for "All Time"

View solution in original post

SplunkTrust
SplunkTrust

@fmathis ,
It depends on your implementation but I was able to send a json with event in the message programmatically as well as using simple curl.

curl -k -H "Authorization: Splunk my_splunk_token" https://my_splunk_host:hec_port/services/collector/event -d '{"sourcetype": "_json", "event": "{\"event\":\"my_event\",\"message\":\"This message has event name\"}"}'

Result
alt text

From your event above, looks like the timestamp is a future one. You may try searching the default index configured with the token and also probably for "All Time"

View solution in original post

Engager

Thanks a lot for your answer, I must have been fooled by the timestamp !
The thing is, I could never find an exemple of sending an event field inside the event object, so I started doubting that might be possible.
Thanks again !

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!