Send event data to Splunk directly via HTTP or HTTPS.
Efficiently ingest data into Splunk without the need for intermediary files or complex configurations.
The benefits of Splunk HEC
-
Efficiency: Reduces latency in data ingestion.
-
Ease of Integration: Uses standard protocols and is compatible with a wide variety of programming languages.
-
Security: Allows secure transmission of sensitive data.
Key features
Splunk HEC is a powerful tool for real-time data ingestion, especially useful in environments where data speed and security are critical.
Real-Time Data Ingestion: sends data in real-time directly to Splunk from applications, services, and devices.
HTTP/HTTPS Protocol: Uses HTTP and HTTPS protocols, making it easy to integrate a plethora of data sources.
No Intermediate Files Needed: Eliminates the need for intermediary log files, reducing latency and simplifying the data ingestion process.
Security: Offers authentication and encryption via HTTPS, ensuring data protection.
Scalability: Handles large volumes of event data, making it suitable for enterprise applications and production environments.
Flexible Configuration: Configures different tokens for various data sources-
Using Splunk Tokens
After logging in to your Splunk Cloud instance using your Splunk account credentials, go to the Splunk Cloud dashboard.
Select Settings and find the list of Tokens. Copy it to your clipboard to start using it in your Sink.
Use the token or script to authenticate requests to your Splunk Cloud instance. Typically, the token is sent in the authorization header of HTTP requests.
Configure an Event Collector
Below are step-by-step instructions on using a Splunk HEC event collector to get the values for the Onum sink.
Configure the Event Collector
-
On the main screen, open the Settings menu and select Data Inputs.
-
Choose the HTTP Event Collector option.
-
Set an access token for authentication.Select the New Token option in the top-right corner to access the token configuration screen. our token.
-
Set the token name.
-
Select at least the main index for quicker event searching.
-
Save the created token's value.
-
Save the created token's value.
On the main screen, go to Search & Reporting. You can search by parameters like index or sourceType. For more information, refer to Splunk's official documentation: What's in Splunk Search.
Once your instance is created, you can process to build your sink.
