---
url: https://simpledatalogs.com/docs/integrations/splunk.md
description: >-
  Use simpledatalogs as a Splunk HEC endpoint from Vector, the OpenTelemetry
  Collector or Fluent Bit, with the ingest key as the HEC token.
---

# Splunk HEC

Ingest serves Splunk's HTTP Event Collector. Use it as the HEC URL and your ingest key as the HEC token.

::: code-group

```yaml [Vector]
sinks:
  simpledatalogs:
    type: splunk_hec_logs
    inputs: [app_logs]
    endpoint: https://edge.simpledatalogs.com
    default_token: sdl_sec_…
    compression: gzip
    encoding:
      codec: json
    acknowledgements:
      indexer_acknowledgements_enabled: false
```

```yaml [OpenTelemetry Collector]
exporters:
  splunk_hec:
    endpoint: https://edge.simpledatalogs.com/services/collector
    token: sdl_sec_…
    disable_compression: false
```

```ini [Fluent Bit]
[OUTPUT]
    Name          splunk
    Match         *
    Host          edge.simpledatalogs.com
    Port          443
    tls           On
    Splunk_Token  sdl_sec_…
```

:::

Tested with Vector 0.43.1, Fluent Bit 3.2.2 and collector-contrib 0.115.1.

::: warning Turn indexer acknowledgment off
`/services/collector/ack` answers `404`. Success already means the data is stored.
:::

## Paths

* `/services/collector/event` (and `/services/collector`) takes HEC events: concatenated JSON objects, `{…}{…}`.
* `/services/collector/raw` takes raw lines, [read like any text body](/api/log-lines), or with the deployment's [template](/api/templates). Raw query parameters (`sourcetype`, `host` …) aren't kept.
* `/services/collector/health` answers the sender's health check.

## How events map

| Field | From the HEC event |
|---|---|
| `message` | A text `event`, masked like a text line; an object event's `message`, `msg` or `log` |
| `level` | `level`, `severity`, `otel.log.severity.text` or `log_level`, in the event or in `fields` |
| `ts` | `time` (epoch seconds) |
| `event_id` | Derived from the content when it has a time, so a retried batch never counts twice |
| `props` | `host`, `source`, `sourcetype`, an object event's other keys, and `fields`. `index` is never kept |

Metric events are skipped. Success is `200 {"text":"Success","code":0}`.

## Next steps

* [Loki](/integrations/loki) and [Datadog logs](/integrations/datadog): other drop-ins.
* [Responses](/api/responses#sentry-datadog-loki-and-splunk): HEC error codes.