Chapter 8. HTTP Event Collector

In this chapter, we will learn about the HTTP Event Collector (HEC) that was released with Splunk v6. This addition has added a new way for websites and their processes to be monitored and improved.

In this chapter we will learn about the following topics:

• What is the HEC?

• How does the HEC work to improve website operations by sending HTTP and HTTPS events directly from an application to Splunk?

• How data flows to the HEC

• How to generate an HEC token

• How to perform a POST request by placing the EC token in the request's authentication header

• How to POST data (in JSON format) to the receiver for the HEC token

• How to send data to the HEC using Web UI click events

• How to log on to the HEC with JavaScript

What is the HEC?

Splunk (in versions 6.0 and up) has created a very useful data tool that is important for Splunk developers to be aware of. The HEC has the important function of collecting and sending HTTP and HTTPS events directly from a web application to Splunk, where it can then be used for analysis, creating alerts, and other effective functions of Splunk.

How does the HEC work?

HTTP and HTTPS events created by web applications contain event metadata, such as time, host, source, source type, and index, as well as other event data, found in curly brackets following the event key. The HEC makes it easy for app developers to add a minimal amount of code in order to send this data, so it's valuable for operational decision making, directly from their apps to Splunk. This is all done in a secure and efficient way, making it easy for apps to be able to Splunk their data.

Typically, an application generates its own log file or uses Document Object Model (DOM) tagging to generate some relevant functional metrics. This is useful and still applicable to traditional multi-page web applications. But web page development has leapt forward in recent years with a new framework called Single Page Application (SPA). The advance of SPA means that most of an application's work in showing HTML results now happens dynamically in the client's browser. Instead of...

How data flows to the HEC?

Let's begin by looking at how data flows to the HEC. This is a multi-step process that is important to understand before we go deeper.

Logging in data

First, data needs to be logged in, but before that it needs to be packaged from the source, which can be done in a number of different ways. These are listed as follows:

• A Splunk logging library, such as Splunk logging for Java or Splunk logging for .NET

• Another agent, such as a JavaScript request library

• The Java Apache HTTP client

• And lastly, some other client, as long as it will appropriately package the event data in JSON format

Before going further, let's review what the JSON format means. A couple of examples of key-value pairs in JSON format are shown here. The key is listed first, then a colon, then the value of that key. Sequences of key-value pairs must be separated by commas:

  "time": 1636289537, 
  "index": "main", 

Using a token with data

Second, the system needs to take each JSON data package and...

Summary

In this chapter, you have learned about the HEC and how it can be used to send HTTP and HTTPS data directly from an application to Splunk. To do this, you learned how to create a token and generate a token key to be used to access the data. You have also learned how to use cURL (for MAC or Linux) and PowerShell (for Windows) to collect the data. And you have created a basic website with buttons that will send the events back to Splunk. Lastly, you have learned how to search the data you have collected from the application.

In the next chapter, we'll go on and learn about recommended ways to work with Splunk.