Getting Data In
Highlighted

Does the HTTP Event Collector reach the indexing queue when using the event end point?

Ultra Champion

We think that the HTTP Event Collector reaches directly the indexing queue when using the event end point. Meaning the props.conf that we place are being ignored. Is this right?

Tags (1)
0 Karma
Highlighted

Re: Does the HTTP Event Collector reach the indexing queue when using the event end point?

SplunkTrust
SplunkTrust

Yes. You don't do props to parse when using propery formed JSON. HEC is a developer method for sending in data. It is expected you form the data correctly and won't need additional parsing. The raw method will act normally in the sense of what you are asking.

View solution in original post

Highlighted

Re: Does the HTTP Event Collector reach the indexing queue when using the event end point?

Ultra Champion

Interesting @starcher - is there a good documentation about it?

0 Karma
Highlighted

Re: Does the HTTP Event Collector reach the indexing queue when using the event end point?

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: Does the HTTP Event Collector reach the indexing queue when using the event end point?

Ultra Champion

Ok, it says -

-- The HTTP Event Collector endpoint extracts the events from the HTTP request and parses them before sending them to indexers. Because the event data formats, as described in this topic, are pre-determined, Splunk Enterprise is able to parse your data quickly, and then sends it to be indexed. This results in improved data throughput and reduced event processing time compared to other methods of getting data in.

You can configure extraction rules in the props.conf file.

So, it's not clear whether the event end point completely bypasses the props.conf.

0 Karma
Highlighted

Re: Does the HTTP Event Collector reach the indexing queue when using the event end point?

Ultra Champion

Thank you @starcher !

0 Karma