Getting Data In

Why are HTTP Event Collector events not appearing the index?

NickLaurent
New Member

Hello fellow Splunkers,
I need some help with HEC (HTTP Event Collector). The problem is that no events are appearing in any indexes. To simplify the issue I set up a test HEC config without SSL (http). I use the curl command with an event "Hello World!" I get a status 200 successful. Let nothing in the indexes.
Environment:
Windows 10, with Splunk Enterprise:
HEC, three unique Tokens with same Sourcetypes, different indexes.

1 Arduino setup to sent events via HEC
1 PI setup to send events via HEC
1 MAC for testing HEC using a curl command.

Thanks

Nick

0 Karma
1 Solution

starcher
Influencer

You will have to find someone's code or write your own for Arduino. But on a PI/Mac you can use Python and here is an existing HEC class for it. https://github.com/georgestarcher/Splunk-Class-httpevent

View solution in original post

0 Karma

starcher
Influencer

You will have to find someone's code or write your own for Arduino. But on a PI/Mac you can use Python and here is an existing HEC class for it. https://github.com/georgestarcher/Splunk-Class-httpevent

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...