hi community
i'd like to
i tried to limit a HEC input to a certain index
i have observed unexpected behavior in several cases.
the configuration on the heavy forwarder goes a follows
[http://hec_instance] description = HEC input for customer1 disabled = 0 index = customer1 indexes = [customer1] token = XXXXXXXX
i am loading test events in json format using curl
case 1) the destination index is specified correctly in the metadata
curl -k "https://hfhost:8088/services/collector/event" -H "Authorization: Splunk XXXXXXXX" -d '{"event": "Hello, world!", "sourcetype": "cool-fields", "index": "customer1", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'
observed outcome:
event ends up in the correct index => expected behavior
case 2) the destination index specified in the metadata does not exist on the indexer cluster
curl -k "https://hfhost:8088/services/collector/event" -H "Authorization: Splunk XXXXXXXX" -d '{"event": "Hello, world!", "sourcetype": "cool-fields", "index": "customer2", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'
observed outcome:
events end up nowhere,
the HF does not bother, sends return code 0 as if everything was fine
the indexer (not the HF) creates a message that there were incoming events for a non existing index
=> not expected behavior
case 3) the destination index is specified in the metadata, it is an existing index but it is not specified in the 'indexes' list for this HEC definition
curl -k "https://hfhost:8088/services/collector/event" -H "Authorization: Splunk XXXXXXXX" -d '{"event": "Hello, world!", "sourcetype": "cool-fields", "index": "main", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'
observed outcome:
no error is generated
event is send to the 'main' index
=> not expected behavior
case 4) the destination index is not specified in the metadata curl -k "https://hfhost:8088/services/collector/event" -H "Authorization: Splunk XXXXXXXX" -d '{"event": "Hello, world!", "sourcetype": "cool-fields", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'
no error is generated
event is send to the 'main' index
=> not expected behavior
has someone observed this before?
is there something stupid in my setup that i fail to see?
additional info:
the HF is running splunk 8.2.2
the indexers are clustered an configured via cluster manager
thanks in advance for any info putting light into this
regards
Carlo
... View more
