Getting Data In

HEC event formatting: How to configure Splunk to show only message field and not all fields?

redg
Loves-to-Learn

Good evening,
With a Java Spring Boot application, I use the library provided by Splunk to send to Splunk the logs using
com.splunk.logging.HttpEventCollectorLogbackAppender.

By default when I do a search in Splunk, the event appears like this (see image below).

redg_0-1673231701551.png

But I'd rather default the search to return results in this form.

redg_1-1673231784318.png

Is it possible to configure Splunk (Source types, etc..)  to display only the message field and not the entire event with all the fields?

 

 

 

Labels (1)
Tags (2)
0 Karma

PaulPanther
Motivator

@redg You could use the HEC Raw-Endpoint (Format events for HTTP Event Collector - Splunk Documentation) and parse & transform the events as needed.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...