Zero bytes in the indexed events

[swlf]

Hi! This is my first time using Splunk and I am on the free tiral version. I setup an HEC token and ran a test on Windows following this command:

curl -k https://prd-p-n38b3.splunkcloud.com:8088/services/collector -H "Authorization: Splunk 78c2aexx-xxxx-xxxxx-xxxx-xxxxx869e53" -d "{\"sourcetype\": \"event\", \"event\": \"Test message\"}"

 While the events are being generated, I see 0 bytes. What am I doing wrong?

I also see the events in the HEC logs but no data.

 

[swlf]

@kiran_panchavat thank you! I followed the format of your search query and now I can see the data. Really appreciate your response and the education.

[swlf]

I think there is an indexing delay in Splunk. I first index now shows the number of bytes indexed. But I still don't know where to find the raw data.  I've been navigating to the HEC page and clicking on the host which shows all the logs but not the raw data.

[livehybrid]

Hi @swlf

 Whilst its showing as 0 bytes, it does show that there are 11 events in your index? 

Try doing a search for all-time on that index (since there is only 11 events) to confirm if this is/isnt the data you are expecting? It could be that the 0 Bytes shown just a rounding error given the small number of events!

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[swlf]

@livehybrid this instance of Splunk Cloud was created yesterday. So all the events are new and from my test. My search is set to last 7 days by default.

But none of the events have the data. If you see the raw event details in my second screenshot, it shows the format "json" but not the raw data.  

Am I looking in the right place? 

[kiran_panchavat · Accepted solution]

@swlf 

HEC receives events via HTTP requests that may include a HEC token, channel identifier header, metadata, or event data formatted as raw text or JSON.

https://docs.splunk.com/Documentation/Splunk/9.4.0/Data/FormateventsforHTTPEventCollector 

The raw JSON is still stored in the _raw field. Try running a search like:

Or, once you run the query you change your view from "List" to "Raw"