How to list indexes which have data that is received by HEC and owners of indexes?

[splunker09]

I am working in clustered environment and getting data from HEC.  I want to list out indexes which are receiving HEC data and the data owners.

[PickleRick]

Depends on what you want to really do. You can list the HEC tokens but the might be restricted to a single index, a number of indexes or not restricted at all. So you can check the config but to find for which indexes the HEC inputs really do receive data, you'd have to check metrics (and even then I'm not sure you'd find that).

And of course that won't tell you the business owners. That's up to you and your environment management processes.

[isoutamo]

As @PickleRick said you must manage information about business owners by your other system. I propose to create inside your onboarding process to add and maintain that information. I have used so called log card which must fulfil when onboarding has done. One part of it is business owner, service managers etc. contact information.

You can see those indexes from input definitions, but there could be some other sources which are using those same indexes also. For that reason you really need a management system which where you have documented that kind of information.

[splunker09]

Yes, I mean business owner

[isoutamo · Accepted solution]

Hi

can you describe what you are meaning with "data owners" (app where it is configured or business owner or ...)?

You could get configured HEC tokens/inputs from HEC node e.g.

| rest splunk_server=<your hec node> /services/data/inputs/http

Of course you should have added that node to peer your SH or just run above towards your HEC node(s) with curl.

That query shows allowed indexes and forced indexes for those tokens.

Another way to check which tokens are used is

https://community.splunk.com/t5/Getting-Data-In/How-can-we-find-out-which-HTTP-Event-Collector-token...

r. Ismo