Getting Data In

What is the reason for an incomplete data HTTP event collector?

igor04653
Loves-to-Learn Everything

server_conf HF.png

Hello dear community

Could you please tell me how to find the reason.

I am using HTTP Event Collector for Kubernetes. I have a configured data token coming into the index. But the team I'm helping assures me that the data in the index gets lost and it's not all sent to Splunk. Maybe someone has already encountered such a problem and perhaps the limits for data transfer are to blame? but I don't know how to check it. I tried to do a search in _internal on the index for which there are complaints. But perhaps you have a better way. Also, an application is installed on my HF, where all the indices and tokens for them are registered there, I found a file with limits. How can I see how much data is coming in for a token and if the values ​​are stuck?

Labels (1)
Tags (1)
0 Karma

wmazur-splunk
Splunk Employee
Splunk Employee

HI do you see any “Content-Length of XXXXX too large (maximum is 1000000) “ errors?

Maybe you will find these links useful:

https://www.splunk.com/en_us/blog/tips-and-tricks/handling-http-event-collector-hec-content-length-t...

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/TroubleshootHTTPEventCollector

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...