- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can we enable Compression algorithms snappy,zlib,std on Splunk HEC
anping_li
New Member
03-19-2024
08:37 PM
The vector Splunk_hec_log [1] support compression algorithms gzip,snappy,zlib and zstd. It seems the server splunk HEC only supports gzip(I am using docker.io/splunk/splunk 9.2). Does splunk HEC support snappy,zlib or zstd? Is this possible to enable this algorithms beside of gzip?
[1] https://vector.dev/docs/reference/configuration/sinks/splunk_hec_logs/#compression
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
PickleRick

SplunkTrust
03-20-2024
04:21 AM
As my colleague used to say - "Try and see". Set up a HEC input and try to push a few requests using different compression methods.
As far as I remember, there are no settings for selectively enabling/disabling compression (methods) on HTTP level so you'll either hit something that Splunk can process or you'll get an error.
