Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- http event collector interval where to set
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I am using HTTP Event collector for one of the sources. And currently the data is getting indexed every Monday that is weekly once. Where can i change this interval settings ?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HTTP event collector is using push mechanism from the application side. So it should be configured in the source application/program from where the data is coming
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HTTP event collector is using push mechanism from the application side. So it should be configured in the source application/program from where the data is coming
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for your reply @renjith_nair
So may be on the source server from where the data is coming from the curl command with the specific token information would be there right. So may be its using a cron to run the curl to run weekly ?
Is my understanding correct ?
Also on another note can we have the HEC configured on HF instead of Searchhead ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes that is correct.
HEC is "instant" so it will be the source server sending the data weekly. Your idea about a cron/curl job being scheduled sounds like you are on the right track!
Yes you can run HEC on a HF rather than the SearchHead - I would suggest that is a better solution.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
