Getting Data In

Splunk HEC response time

lufermalgo
Path Finder

Hello community, how can I build a report that allows me to know what the response time it takes for requests via HTTP Events Collector.

0 Karma
1 Solution

masonmorales
Influencer

Response time would have to be measured from the client side. The metrics that Splunk has available for HEC performance can be found at: https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector

View solution in original post

0 Karma

masonmorales
Influencer

Response time would have to be measured from the client side. The metrics that Splunk has available for HEC performance can be found at: https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector

0 Karma

lufermalgo
Path Finder

Thank you @masonmo for you answer,

It is correct, we have the measurement and it gives us that the average is 800ms which is very high, I don't know if it is because the Splunk Cloud instance is in Brazil.

I just wanted to know if it is possible to make that measurement also on the Splunk side.

Thank you

0 Karma

Vijeta
Influencer

@lufermalgo :- you can look for _indextime of your logs coming from HTTP event collector and compare with the timestamp in logs. The difference will be the response time between logs sent from source and indexed at Splunk.

0 Karma

lufermalgo
Path Finder

thank you @Vijeta for you answer,

Based on your input, should I assume that an HEC request is not released until the event is written in the index?

I usually use that indicator to identify if there is a delay in writing the event in the indexes, but I'm not sure if I can also assume that it would be the response time of HEC.

Thank you.

0 Karma

Vijeta
Influencer

What is meant by HEC response time here? The time HEC event is released from source and reaches Splunk HEC instance or Splunk indexer. The time between HEC instance(HF) to indexer would be very very small rather instant, so I would consider response time as time when event was indexed and time when event was released from the actual source.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...