Getting Data In

How to list indexes which have data that is received by HEC and owners of indexes?

splunker09
Engager

I am working in clustered environment and getting data from HEC.  I want to list out indexes which are receiving HEC data and the data owners.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

can you describe what you are meaning with "data owners" (app where it is configured or business owner or ...)?

You could get configured HEC tokens/inputs from HEC node e.g.

| rest splunk_server=<your hec node> /services/data/inputs/http

Of course you should have added that node to peer your SH or just run above towards your HEC node(s) with curl.

That query shows allowed indexes and forced indexes for those tokens.

Another way to check which tokens are used is

https://community.splunk.com/t5/Getting-Data-In/How-can-we-find-out-which-HTTP-Event-Collector-token...

r. Ismo 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Depends on what you want to really do. You can list the HEC tokens but the might be restricted to a single index, a number of indexes or not restricted at all. So you can check the config but to find for which indexes the HEC inputs really do receive data, you'd have to check metrics (and even then I'm not sure you'd find that).

And of course that won't tell you the business owners. That's up to you and your environment management processes.

isoutamo
SplunkTrust
SplunkTrust

As @PickleRick said you must manage information about business owners by your other system. I propose to create inside your onboarding process to add and maintain that information. I have used so called log card which must fulfil when onboarding has done. One part of it is business owner, service managers etc. contact information.

You can see those indexes from input definitions, but there could be some other sources which are using those same indexes also. For that reason you really need a management system which where you have documented that kind of information.

splunker09
Engager

Yes, I mean business owner

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

can you describe what you are meaning with "data owners" (app where it is configured or business owner or ...)?

You could get configured HEC tokens/inputs from HEC node e.g.

| rest splunk_server=<your hec node> /services/data/inputs/http

Of course you should have added that node to peer your SH or just run above towards your HEC node(s) with curl.

That query shows allowed indexes and forced indexes for those tokens.

Another way to check which tokens are used is

https://community.splunk.com/t5/Getting-Data-In/How-can-we-find-out-which-HTTP-Event-Collector-token...

r. Ismo 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...