Hi,
I'm trying to setup a Splunk HEC within Cribl Stream, and I'm encountering the error "malformed HEC event." I've encountered that error when setting up HECs in Splunk, and to correct the problem I have to go to Source type > Select Source Type > Structured > _json when editing the HEC's settings. I've been looking and reading search results, but so far I haven't found the equivalent setting in Cribl Stream. Where can I find that setting for the HEC please?
There isn't a setting for that in Stream. You can either send to the collector/event endpoint, or the collcetor/_raw endpoint. The collector/event endpoint expects a JSON event. Can you share what the payload you're testing with looks like?
A typical sample:
{ "index": "someindex", "sourcetype": "some_st", "source": "some_path", "event": "your event data here, whether json or plain ol text"}
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.