Getting Data In

Splunk HEC response time

lufermalgo
Path Finder

Hello community, how can I build a report that allows me to know what the response time it takes for requests via HTTP Events Collector.

0 Karma
1 Solution

masonmorales
Influencer

Response time would have to be measured from the client side. The metrics that Splunk has available for HEC performance can be found at: https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector

View solution in original post

0 Karma

masonmorales
Influencer

Response time would have to be measured from the client side. The metrics that Splunk has available for HEC performance can be found at: https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector

0 Karma

lufermalgo
Path Finder

Thank you @masonmo for you answer,

It is correct, we have the measurement and it gives us that the average is 800ms which is very high, I don't know if it is because the Splunk Cloud instance is in Brazil.

I just wanted to know if it is possible to make that measurement also on the Splunk side.

Thank you

0 Karma

Vijeta
Influencer

@lufermalgo :- you can look for _indextime of your logs coming from HTTP event collector and compare with the timestamp in logs. The difference will be the response time between logs sent from source and indexed at Splunk.

0 Karma

lufermalgo
Path Finder

thank you @Vijeta for you answer,

Based on your input, should I assume that an HEC request is not released until the event is written in the index?

I usually use that indicator to identify if there is a delay in writing the event in the indexes, but I'm not sure if I can also assume that it would be the response time of HEC.

Thank you.

0 Karma

Vijeta
Influencer

What is meant by HEC response time here? The time HEC event is released from source and reaches Splunk HEC instance or Splunk indexer. The time between HEC instance(HF) to indexer would be very very small rather instant, so I would consider response time as time when event was indexed and time when event was released from the actual source.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...