I am sending data to Splunk using HEC but after trying all the methods exposed by Splunk API , I am getting all the custom properties nested under a single "message" or "data" attribute. Is there a way so that all my properties are logged in original format and not under a single head.
Actual : { ID: 123,
message: src : "abcd", category: "list" , user: "tchsavy"
}
Expected : { ID : 123 ,
message : "Hello" ,
src : "abcd",
category: "list" ,
user: "tchsavy" }
Splunk HEC is one of the interface to ingest logs to Splunk. Having said that it doesn't do any pre-process of payload that you send. What you send via HEC is exactly what you will find in Splunk search.
If you want in a format that you are expecting you shall pre-process payload the format you want and send it.
Other approach is to ingest the original payload with single attribute message: , data: etc and post-process it during the search-time. However that would be a complex process and extra overhead in Search UI depends on size of payload and logic that you will apply, you can test upfront in search UI using | makeresults command if the logic you intent to write really works then decide.
---
An upvote would be appreciated and Accept solution if this reply helps!