Splunk HTTP Event Collector
1 like1,668 views
The document discusses Splunk's HTTP Event Collector which allows sending events directly to Splunk from various sources using a token-based JSON API. It can be enabled and used to send events by creating and including an authentication token in requests. Events are sent via HTTP POST and the collector is highly performant, scalable, and available. It provides libraries for common languages and can be run on indexers or dedicated collector instances.
Splunk HTTP Event Collector
- 1. Copyright © 2015 Splunk Inc. Splunk HTTP Event Collector
- 2. HTTP Event Collector 2 • A new token-based JSON API for events • Send events directly from anywhere (servers, mobile devices, IOT) • Easy to configure / works out of the box. • Easy to secure • Highly performant, scalable and available
- 3. How To Use • Enable HTTP Event Collector • Create/Get a token • Send events to Splunk using the token – Use HTTP Directly Create a POST request and set the Auth header with the token POST JSON in our event format to the collector – Use logging libraries Support for .NET, Java and JavaScript loggers 3
- 4. Sending Data curl -v http://localhost:8088/services/collector -H "Authorization: Splunk 9F7F64FC-8E3F-4D85- B7F3-F6EC5B71ED1B" -d '{"event":{"uid":"hrottenberg","action","login"}} ' 4
- 5. A few tips • Create tokens per app, department, component, service. etc. Not per user or device especially if you are talking about a large number (> 10000) • Consider partitioning tokens to different indexes. This will speed up searches and make it easy to archive • Consider delegating token management to DevOps / Eng • Explicitly set allowed indexes on the token. If not set, the token can send data to any index. • Use HTTP over HTTPS when you can. You can get about a 30% performance gain. • Ask your devs to batch events. It greatly improves throughtput. 5
- 6. Scale and High Availability 6 Indexers Search Head / Deployment Server
- 7. Scale and High Availability 7 Event Collectors Indexers Search Heads
- 8. Distributed deployment HTTP Event Collector can scale to meet your needs! • Build in to splunkd, nothing special to install • Run directly on the indexer • Or run on a dedicated Collector instance and forward to an indexer • Uses Deployment Server to to sync tokens across the Collector instances 8