Splunk Search

Is there any configuration/way to merge two or more events into one ?

neelpatel02
New Member

I was trying to send data through Splunk HEC (Http event Collector).

curl http://ip:8088/services/collector -H "Authorization: Splunk <HEC_TOKEN>" -d '{"event": "Test1"}{"event": "Test2"}{"event": "Test3"}'

 

So,  in splunk it will goes like

Test1 (-> Event 1)

Test2 (-> Event 2)

Test3 (-> Event 3)

Result I want:

Test1Test2Test3  (as 1 event in splunk.)

 

Labels (1)
Tags (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

What you wanted is expressed as an array in JSON.

curl http://ip:8088/services/collector -H "Authorization: Splunk <HEC_TOKEN>" -d '[{"event": "Test1"},{"event": "Test2"}m{"event": "Test3"}]'
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...