Share HEC Data

When you use HEC to collect data, the Splunk platform sends de-identified usage data ingested through HEC from Splunk add-ons, apps, and connectors to Splunk. This data is used to target pain points and improve functionality in future releases. For information about how this data is collected, stored, and governed, see Share data in Splunk Enterprise.

Types of data collected

deployment.httpEventCollector determines data usage by aggregating the following information:

Data collected Field name
The name of the add-on, app, or connector app
Number of bytes ingested bytes
The version of the add-on, app, or connector version

For example: 

data: { [-]
app: stream333
bytes: 50
version: 3.1

Telemetry data for HEC is collected by default, and you can opt out of data sharing at any time. See How to opt out.

Components

HEC telemetry collects the following information:

Component Description Example
deployment.httpEventCollector Tracks the amount of data that is processed through HEC for an add-on, app, or connector. 
{ [-]
app:
component: deployment.httpEventCollector
data: { [-]
app: stream333
bytes: 50
version: 3.1
}
deploymentID: 18393d55-3552-546c-a5ab-61a96a04ae04
eventID: 367E743C-D629-4B25-B46A-78447116F3A4
executionID: 319FB159-0B47-4CA0-B29D-4CD0EDDF0DCF
optInRequired: 1
timestamp: 1586974636
type: event
userID: 574f5debd4e54c49ef018a6e1bde0379df499a23a865ab83e8d23d1170256f40
visibility: [ [-]
anonymous
support
]
}