Sending data to Splunk using HEC

[deepasha1989]

I am sending data to Splunk using HEC but after trying all the methods exposed by Splunk API , I am getting all the custom properties nested under a single "message" or "data" attribute. Is there a way so that all my properties are logged in original format and not under a single head.

Actual : { ID: 123,

message: src : "abcd", category: "list" , user: "tchsavy"  

}

Expected : { ID : 123 ,

message : "Hello" ,

src : "abcd",

category: "list" ,

user: "tchsavy" } 

[venkatasri]

Hi @deepasha1989 

Splunk HEC is one of the interface to ingest logs to Splunk. Having said that it doesn't do any pre-process of payload that you send. What you send via HEC is exactly what you will find in Splunk search.

If you want in a format that you are expecting you shall pre-process payload the format you want and send it. 

Other approach is to ingest the original payload with single attribute message: , data: etc and post-process it during the search-time. However that would be a complex process and extra overhead in Search UI depends on size of payload and logic that you will apply, you can test upfront in search UI using | makeresults command if the logic you intent to write really works then decide.

---

An upvote would be appreciated and Accept solution if this reply helps!

[venkatasri]

An upvote would be appreciated and Accept solution if this reply helps!