Getting Data In

HTTP Event Collector do not completly index data

nanapark
New Member

While trying to index data using the HTTP Event Collector, I got some data loss, especially in the last row.
Data format used is the following:

  • Multiple lines separated by CRLF
  • encode UTF-8
  • Data's format : flat JSON

Example:
{"field1":1,"field2":2,"field3":"smth"} CRLF
{"field1":2,"field2":3,"field3":"smth"} CRLF
{"field1":3,"field2":4,"field3":"smth"}

Anyone have an idea about this problem?

0 Karma

amiftah
Communicator

Can you show your sourcetype in props.conf ?

0 Karma

nanapark
New Member

Unfortunately, I do not have access to the props.conf
We found that special characters are making trouble for the HEC such as: double quotes “ or é or è ...
Is there any solution to let the HEC accept those characters?

0 Karma

nanapark
New Member

I don't know if this can help. In indexed data I found this : sourcetype = _json

0 Karma

amiftah
Communicator

Which Splunk version are you using?

0 Karma

nanapark
New Member

we are using splunk 6.5.3

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...