About swlf

swlf · ‎02-21-2025

@kiran_panchavat thank you! I followed the format of your search query and now I can see the data. Really appreciate your response and the education.

swlf · ‎02-21-2025

I think there is an indexing delay in Splunk. I first index now shows the number of bytes indexed. But I still don't know where to find the raw data. I've been navigating to the HEC page and clicking on the host which shows all the logs but not the raw data. Screenshot 2025-02-21 at 4.45.53 PM.png

swlf · ‎02-21-2025

@livehybrid this instance of Splunk Cloud was created yesterday. So all the events are new and from my test. My search is set to last 7 days by default. But none of the events have the data. If you see the raw event details in my second screenshot, it shows the format "json" but not the raw data. Screenshot 2025-02-21 at 3.43.53 PM.png Am I looking in the right place?

swlf · ‎02-21-2025

Hi! This is my first time using Splunk and I am on the free tiral version. I setup an HEC token and ran a test on Windows following this command: curl -k https://prd-p-n38b3.splunkcloud.com:8088/services/collector -H "Authorization: Splunk 78c2aexx-xxxx-xxxxx-xxxx-xxxxx869e53" -d "{\"sourcetype\": \"event\", \"event\": \"Test message\"}" While the events are being generated, I see 0 bytes. What am I doing wrong? Screenshot 2025-02-21 at 11.39.44 AM.png I also see the events in the HEC logs but no data. Screenshot 2025-02-21 at 11.44.35 AM.png

Posts	4
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎02-21-2025

Online Status	Offline
Date Last Visited	‎02-22-2025 05:09 AM

Zero bytes in the indexed events

Re: Zero bytes in the indexed events

Re: Zero bytes in the indexed events

Re: Zero bytes in the indexed events

Zero bytes in the indexed events

Join the Conversation

Zero bytes in the indexed events

Re: Zero bytes in the indexed events

Re: Zero bytes in the indexed events

Re: Zero bytes in the indexed events

Zero bytes in the indexed events