Ask Your Question

Splunk HTTP Event Collector Raw Event

asked 2019-01-16 16:40:00 -0500

omerl gravatar image

Hey, I'm trying to stream Windows Event Log events to Splunk. I found out that using the built-in Splunk destination on StreamSets does not support sending json events without the event field in it.

Splunk supports two ways of receiving from HEC - json with event field, and raw option, which just receives the raw data.

Is there any option on StreamSets to send the event as raw event? If not - is there a simple way to generate a new json object, with event field, and put the record in it?


edit retag flag offensive close merge delete


How is your Windows Event Log data currently showing up in the pipeline?

metadaddy gravatar imagemetadaddy ( 2019-01-16 16:42:52 -0500 )edit

I have an Edge collector which is set to send logs to HTTP Client destination, and the destination sends the events, as json, to a central Data Collector, which send all the events (multiple Edge DCs) to splunk destination

omerl gravatar imageomerl ( 2019-01-16 16:46:02 -0500 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-01-16 16:52:43 -0500

metadaddy gravatar image

You can move the entire record content into the /event field using an Expression Evaluator:

image description

You can then set additional Splunk event metadata fields such as /host and /source.

edit flag offensive delete link more
Login/Signup to Answer

Question Tools

1 follower


Asked: 2019-01-16 16:40:00 -0500

Seen: 159 times

Last updated: Jan 16 '19