About apider

apider · ‎10-25-2019

The problem this is causing me is that I somehow end up with events with TWO sourcetypes, as it seems. When i search: index=test sourcetype="aiwa:request" I don't get a match. But when i do: index=test sourcetype="httpevent" I DO get a match. Really confusing, as it looks like the event has BOTH souretypes. I am posting the event to HEC raw endpoint with sourcetype set to "aiwa:request". Is this expected behavior?

apider · ‎10-24-2019

Hi, I have a raw HEC set up as follows (no sourcetype set): [http://aiwa_request_input] disabled = 0 index = test indexes = test sourcetype = token = xxxxxxx-xxx-x-x-xx When I put an event into it and specify the sourcetype in the event it gets indexed as two sourcetypes; httpevent and "my" sourcetype "aiwa:request". host = aiwa3dev-aiwa3-dev.cumulus.sebank.seindex = testlinecount = 1punct = {"":"--::.","":"","":":","":{"":"","":"","":{"":""source = http:aiwa_request_inputsourcetype = httpevent sourcetype = aiwa:requestsplunk_server = lsp7150c.sebank.se From above: sourcetype = httpevent sourcetype = aiwa:request How can I change this to only be the ST in the event itself. My props & transforms are blank. Cheers /F

apider · ‎10-07-2019

Actuallt posting to the RAW endpoint solved the problem and the "time" field gets set as "_time"

apider · ‎10-07-2019

Ah, thank you guys! Of course it's only the RAW endpoint that enables me to do this. Have learned something today. Did not get up from bed in vain this morning 🙂 Cheers /Filip { "time": "2019-10-02T16:29:53.817", "event": { "eventType": "Computer Room Temp Monitoring", "location": { "dataCenter": "PDC1", "hostname": "PELLE", "dateStart": "2019-10-02T16:24:43", "dateEnd": "2019-10-02T16:29:53.817", "temp": { "average": 23, "min": 22, "max": 24 } } } }

apider · ‎10-04-2019

Question: Did you use the "Exact" or "Explicit" JSON fields from this example? https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/HECExamples

apider · ‎10-03-2019

Tried your conf in props, but it is not working for me. Still get the indexing time only. It is a singe instance installation (test). the props,conf is in $SPLUNK_HOME/etc/system/local

apider · ‎10-03-2019

Hi, I have this json event I put in trough HEC: { "time": "2019-10-01T11:29:53.817", "eventType": "Computer Room Temp Monitoring", "location": { "dataCenter": "PDC1", "hostname": "PELLE", "temp": { "dateStart": "2019-10-02T16:24:43", "dateEnd": "2019-10-02T16:29:53.817", "average": 23, "min": 21, "max": 24 } } } But I am unable to set the "time" as the actual event time: Have tried with both "_json" and my own sourcetype but to no avail. Have tried with both EPOCH and time format as above. My own sourcetype looks like this in props.conf: [crtemp] DATETIME_CONFIG = INDEXED_EXTRACTIONS = json KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true TIMESTAMP_FIELDS = time category = Structured description = JavaScript Object Notation format. For more information, visit http://json.org/ disabled = false pulldown_type = 1 #TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3Q TIME_FORMAT = TIME_PREFIX = time MAX_TIMESTAMP_LOOKAHEAD = 30

Posts	7
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎10-03-2019

Online Status	Offline
Date Last Visited	‎08-18-2022 10:14 AM

HEC _raw sourcetype

Http Event Collector ignores JSON timestamp

Re: HEC _raw sourcetype

HEC _raw sourcetype

Re: Http Event Collector ignores JSON timestamp

Re: Http Event Collector ignores JSON timestamp

Re: Http Event Collector ignores JSON timestamp

Re: Http Event Collector ignores JSON timestamp

Http Event Collector ignores JSON timestamp