Splunk HTTP Event Collector
Embed
<a href="https://forumulate.com/p/watchtower/docs/splunk-hec"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/b60877dc-57b4-427b-843c-937169a3779d/social-card.svg?v=3e7ae33eec8b" alt="Splunk HTTP Event Collector" width="600" height="315"></a>Send events from a Splunk forwarder, the OpenTelemetry splunk_hec exporter, Fluent Bit or Vector. Needs an ingestion key with ingest:logs (plus ingest:metrics for metric events). Use the key as the HEC token: Authorization: Splunk <key>.
POST /services/collector/event
POST /services/collector/raw/event takes one or more JSON events (time in seconds, host, source, sourcetype, index, event, fields). They become the attributes host.name, log.file.path, splunk.sourcetype and splunk.index. A string event is the body; an object event becomes the JSON body and its flattened keys become attributes. event: "metric" with fields: {metric_name, _value, ...} (or metric_name:<name> keys) is stored as a gauge; the other fields are dimensions. /raw takes one event per line, with host, source, sourcetype and index as query parameters. The answer is {"text":"Success","code":0}.
Delivery is at-least-once. Do not set wt.* fields; the gateway deletes them.
Status: structure-checked, not yet run against a real HEC client.