Getting Data In

Can the HTTP Event Collector provide the channel identifier in the Splunk events

New Member

We are sending data to the HTTP Event Collector raw endpoint from multiple systems, but we have no control over the data itself (coming from a third party). We are generating arbitrary channel identifiers for each system, but when we query the data the channel identifier is not present. Unfortunately the data itself does not provide a simple way to determine the system. The system name is sent in a special header, but I doubt the HEC is inspecting that header and I could find no documentation about HEC using headers other than the ones it specifies.

Is there a way to get either the channel identifier or an arbitrary header value used so we can determine which determine which system is sending the data and distinguish between the many systems using the HEC to send data?

0 Karma

Splunk Employee
Splunk Employee

Hi @redbugz

If you are sending data in Splunk via a different source (channel identifier) then you can search events for that particular source by below query :

source="http:(source_name OR channel identifier)"

As here let's take one example if you have created one HEC token and its name is "network_demo" and that is for your network instance logs then you can search particular network logs by searching source="http:network_demo".

For more information about HEC, Please follow below doc:


Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...