Splunk HEC

Ingest serves Splunk's HTTP Event Collector. Use it as the HEC URL and your ingest key as the HEC token.

Vector

sinks:
  simpledatalogs:
    type: splunk_hec_logs
    inputs: [app_logs]
    endpoint: https://edge.simpledatalogs.com
    default_token: sdl_sec_…
    compression: gzip
    encoding:
      codec: json
    acknowledgements:
      indexer_acknowledgements_enabled: false

OpenTelemetry Collector

exporters:
  splunk_hec:
    endpoint: https://edge.simpledatalogs.com/services/collector
    token: sdl_sec_…
    disable_compression: false

Fluent Bit

[OUTPUT]
    Name          splunk
    Match         *
    Host          edge.simpledatalogs.com
    Port          443
    tls           On
    Splunk_Token  sdl_sec_…

Tested with Vector 0.43.1, Fluent Bit 3.2.2 and collector-contrib 0.115.1.

Turn indexer acknowledgment off

/services/collector/ack answers 404. Success already means the data is stored.

Paths

• /services/collector/event (and /services/collector) takes HEC events: concatenated JSON objects, {…}{…}.
• /services/collector/raw takes raw lines, read like any text body, or with the deployment's template. Raw query parameters (sourcetype, host …) aren't kept.
• /services/collector/health answers the sender's health check.

How events map

Field	From the HEC event
message	A text event, masked like a text line; an object event's message, msg or log
level	level, severity, otel.log.severity.text or log_level, in the event or in fields
ts	time (epoch seconds)
event_id	Derived from the content when it has a time, so a retried batch never counts twice
props	host, source, sourcetype, an object event's other keys, and fields. index is never kept

Metric events are skipped. Success is 200 {"text":"Success","code":0}.

Next steps

• Loki and Datadog logs: other drop-ins.
• Responses: HEC error codes.