Getting Data In

Where does the HEC data gets stored ?

surekhasplunk
Communicator

I have HTTP event collector well configured using token from a client. 

Now i want to understand where does these json format events gets stored? 

I mean the exact json logs which are coming via HEC, are they stored somewhere in our splunk environment ? 

Labels (1)
Tags (1)
0 Karma
1 Solution

ak9092
Path Finder

@surekhasplunk if you're asking if some file is created in Splunk environment before indexing the events coming over HEC, then that's not the case as i believe HTTP events directly gets indexed to the specified index name in the input stanza.

 

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
HEC stores data in your Splunk indexes.
---
If this reply helps you, Karma would be appreciated.

ak9092
Path Finder

@surekhasplunk if you're asking if some file is created in Splunk environment before indexing the events coming over HEC, then that's not the case as i believe HTTP events directly gets indexed to the specified index name in the input stanza.

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

the one can also define used (or want to use) index on HEC json.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/FormateventsforHTTPEventCollector

For that reason it's good to define allowed / used index on inputs.conf per used token.

And of course the one must first define used indexes on indexers otherwise events goes to the last change index which is usually main-index.

r. Ismo

isoutamo
SplunkTrust
SplunkTrust

Hi

Usually in inputs.conf there are definitions under every input stanza in which indexes events can and/or must stored. 

See more from https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/UsetheHTTPEventCollector

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...