Splunk HTTP Event Collector (HEC)

The HTTP Event Collector (HEC) lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP (HTTPS) protocols. HEC uses a token-based authentication model. You can generate a token and then configure a logging library or HTTP client with the token to send data to HEC in a specific format. This process eliminates the need for a Splunk forwarder when you send application events.

After you enable HEC, you can use HEC tokens in your app to send data to HEC. You do not need to include Splunk credentials in your app or supported files to access the Splunk platform instance.

See the official Splunk documentation for further information.

Configuration

• HTTP endpoint URL: the URL of the Splunk endpoint. e.g. https://<host>.splunkcloud.com:8088/services/collector/event or https://<host>.splunkcloud.com:443/services/collector/event
• HTTP header: an "Authorization:" header with the Splunk token. e.g. Authorization: Splunk <token>
• Event format: the event format, for Splunk the default format is {"time": %timestamp%, "host": "%hostname%", "event": %message%}

See the format events for Splunk HTTP even collector.