How data flows to the HEC

Let's begin by looking at how data flows to the HEC. This is a multi-step process that is important to understand.

Logging data

Before Splunk can capture any data, it needs to be packaged from the source, which can be done in a number of different ways:

• A Splunk logging library for Java, JavaScript, or .NET
• Another agent, such as a JavaScript request library
• The Java Apache HTTP client
• And lastly, some other client packing data in JSON or raw formats

Before going further, let's review what the JSON format means. A couple of examples of key-value pairs in JSON format are shown here. The key is listed first, then a colon, and then the value of that key. Sequences of key-value pairs must be separated by commas:

{
    "time": 1519413100, // epoch time
    "host": "localhost",
    "source": "datasource",
    "sourcetype": "txt",
    "index": "main",
    "event": { "Hello world!" }
}

Using a token with data

In addition to the formatting of the event data, each data package will...