Getting Data In

Sending data to Splunk using HEC

deepasha1989
New Member

I am sending data to Splunk using HEC but after trying all the methods exposed by Splunk API , I am getting all the custom properties nested under a single "message" or "data" attribute. Is there a way so that all my properties are logged in original format and not under a single head.

Actual : { ID: 123,

message: src : "abcd", category: "list" , user: "tchsavy"  

}

Expected : { ID : 123 ,

message : "Hello" ,

src : "abcd",

category: "list" ,

user: "tchsavy" } 

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @deepasha1989 

Splunk HEC is one of the interface to ingest logs to Splunk. Having said that it doesn't do any pre-process of payload that you send. What you send via HEC is exactly what you will find in Splunk search.

If you want in a format that you are expecting you shall pre-process payload the format you want and send it. 

Other approach is to ingest the original payload with single attribute message: , data: etc and post-process it during the search-time. However that would be a complex process and extra overhead in Search UI depends on size of payload and logic that you will apply, you can test upfront in search UI using | makeresults command if the logic you intent to write really works then decide.

---

An upvote would be appreciated and Accept solution if this reply helps!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...