Getting Data In

Where does the HEC data gets stored ?

surekhasplunk
Communicator

I have HTTP event collector well configured using token from a client. 

Now i want to understand where does these json format events gets stored? 

I mean the exact json logs which are coming via HEC, are they stored somewhere in our splunk environment ? 

Labels (1)
Tags (1)
0 Karma
1 Solution

ak9092
Path Finder

@surekhasplunk if you're asking if some file is created in Splunk environment before indexing the events coming over HEC, then that's not the case as i believe HTTP events directly gets indexed to the specified index name in the input stanza.

 

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
HEC stores data in your Splunk indexes.
---
If this reply helps you, an upvote would be appreciated.

ak9092
Path Finder

@surekhasplunk if you're asking if some file is created in Splunk environment before indexing the events coming over HEC, then that's not the case as i believe HTTP events directly gets indexed to the specified index name in the input stanza.

 

 

View solution in original post

0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

the one can also define used (or want to use) index on HEC json.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/FormateventsforHTTPEventCollector

For that reason it's good to define allowed / used index on inputs.conf per used token.

And of course the one must first define used indexes on indexers otherwise events goes to the last change index which is usually main-index.

r. Ismo

soutamo
SplunkTrust
SplunkTrust

Hi

Usually in inputs.conf there are definitions under every input stanza in which indexes events can and/or must stored. 

See more from https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/UsetheHTTPEventCollector

r. Ismo

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!