We are noticing that that same data received via the HTTP Event Collector is not searchable by Field like data received via our Forwarders.
Note how EventName field IS NOT being picked up from Event received through HEC:
Note how EventName IS getting picked up from Event received through Forwarders:
It seems that the events received through the HEC are treated as one large Blob of data and are not parsed or indexed the same way by Splunk. I there anything that can be done in the request to the HEC or to an indexer to resolve this?
Thanks.