Splunk HTTP Event Collector

Splunk HTTP Event Collector (HEC) is how applications send events into Splunk Enterprise and Splunk Cloud Platform over HTTPS with a token.

Authentication

• HEC token

Actions

• Check acknowledgmentsAsk whether events sent with indexer acknowledgment on have been written to an index - the confirmation an audit trail needs before a workflow treats an event as durable.
• Check healthCheck whether the HTTP Event Collector is accepting data - before a large backfill, or to tell a Splunk outage from a rejected event.
• Send eventSend one event to Splunk through the HTTP Event Collector - an audit record of an access grant, a provisioning result, or any fact a security team wants searchable in Splunk.
• Send eventsSend a batch of events to Splunk in one request through the HTTP Event Collector - a reconciliation run's findings, or a day's access-review decisions.
• Send raw dataDestructiveSend raw text to Splunk through the HTTP Event Collector's raw endpoint, which breaks it into events with the sourcetype's own line-breaking and timestamp rules - for log lines or a file's contents that are not already JSON events.

Product names, logos and brands are the property of their respective owners and are used here for identification only. Their use does not imply endorsement by, or affiliation with, those owners.