How data flows to the HEC

Let's begin by looking at how data flows to the HEC. This is a multi-step process that is important to understand.

Logging data

Before Splunk can capture any data, it needs to be packaged from the source, which can be done in a number of different ways:

• A Splunk logging library for Java, JavaScript, or .NET
• Another agent, such as a JavaScript request library
• The Java Apache HTTP client
• And lastly, some other client packing data in JSON or raw formats

Before going further, let's review what the JSON format means. A couple of examples of key-value pairs in JSON format are shown here. The key is listed first, then a colon, and then the value of that key. Sequences of key-value pairs must...