The document discusses Splunk's HTTP Event Collector which allows sending events directly to Splunk from various sources using a token-based JSON API. It can be enabled and used to send events by creating and including an authentication token in requests. Events are sent via HTTP POST and the collector is highly performant, scalable, and available. It provides libraries for common languages and can be run on indexers or dedicated collector instances.

1. Copyright © 2015 Splunk Inc.
Splunk HTTP Event
Collector

2. HTTP Event Collector
2
• A new token-based JSON API for
events
• Send events directly from anywhere
(servers, mobile devices, IOT)
• Easy to configure / works out of the
box.
• Easy to secure
• Highly performant, scalable and
available

3. How To Use
• Enable HTTP Event Collector
• Create/Get a token
• Send events to Splunk using the token
– Use HTTP Directly
 Create a POST request and
set the Auth header with the token
 POST JSON in our event format to the
collector
– Use logging libraries
 Support for .NET, Java and JavaScript loggers
3

4. Sending Data
curl -v http://localhost:8088/services/collector
-H "Authorization: Splunk 9F7F64FC-8E3F-4D85-
B7F3-F6EC5B71ED1B" -d
'{"event":{"uid":"hrottenberg","action","login"}}
'
4

5. A few tips
• Create tokens per app, department, component, service. etc. Not per user
or device especially if you are talking about a large number (> 10000)
• Consider partitioning tokens to different indexes. This will speed up
searches and make it easy to archive
• Consider delegating token management to DevOps / Eng
• Explicitly set allowed indexes on the token. If not set, the token can send
data to any index.
• Use HTTP over HTTPS when you can. You can get about a 30% performance
gain.
• Ask your devs to batch events. It greatly improves throughtput.
5

6. Scale and High Availability
6
Indexers
Search Head /
Deployment Server

7. Scale and High Availability
7
Event Collectors Indexers Search Heads

8. Distributed deployment
HTTP Event Collector can scale to meet your needs!
• Build in to splunkd, nothing special to install
• Run directly on the indexer
• Or run on a dedicated Collector instance and forward to an indexer
• Uses Deployment Server to to sync tokens across the Collector
instances
8

9. Resources
Documentation: http://dev.splunk.com/view/event-collector/SP-CAAAE6M
Blog: http://blogs.splunk.com/2015/10/06/http-event-collector-your-direct-event-pipe-to-splunk-6-3
9