Where does the HEC data gets stored ?

[surekhasplunk]

I have HTTP event collector well configured using token from a client. 

Now i want to understand where does these json format events gets stored? 

I mean the exact json logs which are coming via HEC, are they stored somewhere in our splunk environment ? 

[richgalloway]

HEC stores data in your Splunk indexes.

[ak9092 · Accepted solution]

@surekhasplunk if you're asking if some file is created in Splunk environment before indexing the events coming over HEC, then that's not the case as i believe HTTP events directly gets indexed to the specified index name in the input stanza.

[isoutamo]

Hi

the one can also define used (or want to use) index on HEC json.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/FormateventsforHTTPEventCollector

For that reason it's good to define allowed / used index on inputs.conf per used token.

And of course the one must first define used indexes on indexers otherwise events goes to the last change index which is usually main-index.

r. Ismo

[isoutamo]

Hi

Usually in inputs.conf there are definitions under every input stanza in which indexes events can and/or must stored. 

See more from https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/UsetheHTTPEventCollector

r. Ismo