Getting Data In

How to optimize data (key/value pairs) to be injected into Splunk 6.3 using the HTTP Event Collector?

simpkins1958
Contributor

We are adding a new feature to our product to send data in key value pairs into Splunk using the new 6.3 Http Event Collector. We want our data in Splunk to be easily usable by customers as they build Splunk dashboards.

We have some values that change infrequently. Should we be sending the value that changes infrequently with each event we send to Splunk, or just when it actually changes? Or should we send that value only when it changes?

2015-11-09 16:00:00.000 sentbytes=1000 receivedbytes=50 signalstrength=good
2015-11-09 16:00:05.000 sentbytes=10 receivedbytes=750 signalstrength=good
2015-11-09 16:00:10.000 sentbytes=109 receivedbytes=0 signalstrength=good
2015-11-09 16:00:15.000 sentbytes=244 receivedbytes=987 signalstrength=poor

or

2015-11-09 16:00:00.000 sentbytes=1000 receivedbytes=50 signalstrength=good
2015-11-09 16:00:05.000 sentbytes=10 receivedbytes=750 
2015-11-09 16:00:10.000 sentbytes=109 receivedbytes=0
2015-11-09 16:00:15.000 sentbytes=244 receivedbytes=987 signalstrength=poor
0 Karma

jeffland
SplunkTrust
SplunkTrust

It's possible (and quite simple if you know how, a simple streamstats with coalesce should do) to have the data from an earlier event appear in the following events. If you want the easiest solution for your customers however, then send every value with every event. The tradeoff is more license usage.

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...