Splunk | Configure an HTTP event collector

Set up an Index and an HTTP Event Collector in Splunk. This will prepare you to utilize the Perfect Splunk project.

For more information on the Perfecto Splunk project, see the article here.

The HTTP Event Collector is required to send the data to Splunk via an API command. Follow the below steps to creat the collector if you are running Splunk Enterprise.

If you are a Splunk Cloud customer, you must contact support to have them create an HEC for you that is public facing. You will need to provide support an index name and a data source type when you submit the request. Creating the custom data source type needed for the Perfecto Splunk Connector can be found here can be found here.

Important: This document includes references to a third-party product, Splunk. The user interface and usage of third-party products are subject to change without notice. For the latest published information about Splunk, see https://docs.splunk.com/Documentation.

Create the HTTP Event Collector

  1. Select settings and then Data Inputs.

  2. Select HTTP Event Collector.

  3. Select New Token.

  4. Enter a data collector name and click next.

  5. Add an index you wish for the HEC to use to the selected items list and click review.

  6. On the next screen, click Submit.

  7. Ensure the HTTP Event Collector is now enabled.

Enable tokens

  1. If you have an icon in the top right indicating all tokens are disabled, click Global Settings.

  2. Select enabled and then click Save.

Configure the HEC for input

  1. Select Edit on the Data Input you created.

  2. Enter a Source name.

  3. Select Source Type as custom source type you created by following the process here.

  4. Ensure the index you created in the selected index list.

  5. Click save.

Increase the event data truncate limit

By default, Splunk limits messages to 10,000 bytes (characters). You can increase this limit in the Splunk properties files. Depending on the size of your JSON records, this may or may not need to be modified.

  1. Navigate to your Splunk directory and open the props.conf file in the \etc\system\default directory.

  2. Modify the TRUNCATE property under the default section at the top of the file to change the maximum characters for a message, for example to 1,000,000.

  3. After the setting has been changed, restart your Splunk instance.