Getting Data In

Sending logs using Splunk HEC

cyber_castle
Path Finder

Hello,

We have a requirement to send the logs from one of our IoT devices in to the Splunk. As it doesnt have syslog functionality/ install splunk agent, we are planning to use HEC.

I have gone through the Splunk documentation on HEC and created the token and did some testing using curl and everything looks good. (curl -k http://localhost:8088/services/collector -H "Authorization:Splunk " -d "{json formatted entries}").

Now what should be the next step to collect the actual logs from the device. Whether the developer needs to output the logs in to the above Splunk HEC token?

1 Solution

Prewin027
Explorer

Hi,

Yes. Now using created HEC Token you can use your application to send data to Splunk HEC.

There are several options for sending data to HTTP Event Collector:

You can make an HTTP request using your favorite HTTP client and send your JSON-encoded events.
As a developer, you can use the Java, JavaScript (node.js), and .NET logging libraries in your application to send data to HEC. These libraries are compatible with popular logging frameworks.

http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE2K

http://dev.splunk.com/view/splunk-loglib-dotnet/SP-CAAAEX4

View solution in original post

0 Karma

Prewin027
Explorer

Hi,

Yes. Now using created HEC Token you can use your application to send data to Splunk HEC.

There are several options for sending data to HTTP Event Collector:

You can make an HTTP request using your favorite HTTP client and send your JSON-encoded events.
As a developer, you can use the Java, JavaScript (node.js), and .NET logging libraries in your application to send data to HEC. These libraries are compatible with popular logging frameworks.

http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE2K

http://dev.splunk.com/view/splunk-loglib-dotnet/SP-CAAAEX4

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...