Hi Experts,
I configured HEC input, after that I run curl command using that token, it returns {"text":"Success","code":0}
.
But no event comes into my INDEX.
Any suggestions on how to proceed?
Thanks in advance.
Hi,
Can you please change sourcetype from _json
to json_no_timestamp
for "test" token and try again?
Hi,
Can you please change sourcetype from _json
to json_no_timestamp
for "test" token and try again?
Thanks, its working 🙂
Great, I have converted my comment to answer so you can accept it.
Have you searched in the default index which you have configured while creating the token ?
Actually I created the HEC input in a Index(Test) , so nothing is come in default index.
Even for "All Time" time range?