Getting Data In

How to list indexes which have data that is received by HEC and owners of indexes?

splunker09
Engager

I am working in clustered environment and getting data from HEC.  I want to list out indexes which are receiving HEC data and the data owners.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

can you describe what you are meaning with "data owners" (app where it is configured or business owner or ...)?

You could get configured HEC tokens/inputs from HEC node e.g.

| rest splunk_server=<your hec node> /services/data/inputs/http

Of course you should have added that node to peer your SH or just run above towards your HEC node(s) with curl.

That query shows allowed indexes and forced indexes for those tokens.

Another way to check which tokens are used is

https://community.splunk.com/t5/Getting-Data-In/How-can-we-find-out-which-HTTP-Event-Collector-token...

r. Ismo 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Depends on what you want to really do. You can list the HEC tokens but the might be restricted to a single index, a number of indexes or not restricted at all. So you can check the config but to find for which indexes the HEC inputs really do receive data, you'd have to check metrics (and even then I'm not sure you'd find that).

And of course that won't tell you the business owners. That's up to you and your environment management processes.

isoutamo
SplunkTrust
SplunkTrust

As @PickleRick said you must manage information about business owners by your other system. I propose to create inside your onboarding process to add and maintain that information. I have used so called log card which must fulfil when onboarding has done. One part of it is business owner, service managers etc. contact information.

You can see those indexes from input definitions, but there could be some other sources which are using those same indexes also. For that reason you really need a management system which where you have documented that kind of information.

splunker09
Engager

Yes, I mean business owner

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

can you describe what you are meaning with "data owners" (app where it is configured or business owner or ...)?

You could get configured HEC tokens/inputs from HEC node e.g.

| rest splunk_server=<your hec node> /services/data/inputs/http

Of course you should have added that node to peer your SH or just run above towards your HEC node(s) with curl.

That query shows allowed indexes and forced indexes for those tokens.

Another way to check which tokens are used is

https://community.splunk.com/t5/Getting-Data-In/How-can-we-find-out-which-HTTP-Event-Collector-token...

r. Ismo 

Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...