Getting Data In

Does the HTTP Event Collector reach the indexing queue when using the event end point?

ddrillic
Ultra Champion

We think that the HTTP Event Collector reaches directly the indexing queue when using the event end point. Meaning the props.conf that we place are being ignored. Is this right?

Tags (1)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

Yes. You don't do props to parse when using propery formed JSON. HEC is a developer method for sending in data. It is expected you form the data correctly and won't need additional parsing. The raw method will act normally in the sense of what you are asking.

View solution in original post

starcher
SplunkTrust
SplunkTrust

Yes. You don't do props to parse when using propery formed JSON. HEC is a developer method for sending in data. It is expected you form the data correctly and won't need additional parsing. The raw method will act normally in the sense of what you are asking.

ddrillic
Ultra Champion

Thank you @starcher !

0 Karma

ddrillic
Ultra Champion

Interesting @starcher - is there a good documentation about it?

0 Karma

starcher
SplunkTrust
SplunkTrust
0 Karma

ddrillic
Ultra Champion

Ok, it says -

-- The HTTP Event Collector endpoint extracts the events from the HTTP request and parses them before sending them to indexers. Because the event data formats, as described in this topic, are pre-determined, Splunk Enterprise is able to parse your data quickly, and then sends it to be indexed. This results in improved data throughput and reduced event processing time compared to other methods of getting data in.

You can configure extraction rules in the props.conf file.

So, it's not clear whether the event end point completely bypasses the props.conf.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...