2022-06-27

How to batch the app events with max of 1000 events per second when using Splunk HTTP Event Collector (HEC)

I need to send the batched events to Splunk HTTP Event Collector, say 1000 events per second.

Below is the example of 5 log events that are sent to Splunk HEC -

% curl "https://splunk-example.com:8088/services/collector/raw?channel=093DCD-BC98-8UET-8AFE-8413C3825C4C&sourcetype=test_type&index=test_index"
-H "Authorization: Splunk ******-****-****-****-*********" -d '<log line 1>   <log line 2>  <log line 3>  <log line 4>

  Output:  {"text":"Success","code":0}%

So how do I configure to send the application logs as 1000 events/seconds to Splunk HEC?



No comments:

Post a Comment