HTTP Event Collector (HEC) configuration reference

The HTTP Event Collector (HEC) lets you send data and application events to your Splunk platform deployment over the HTTP and Secure HTTP (HTTPS) protocols. Data Manager creates HEC tokens for each of the following data sources:

Data Source	HEC token name
Amazon GuardDuty	data-manager-guardduty-{input_id}
AWS Security Hub	data-manager-securityhub-{input_id}
AWS IAM Access Analyzer	data-manager-iam-aa-{input_id}
AWS Cloudtrail	data-manager-cloudtrail-{input_id}
AWS IAM credential report and metadata	data-manager-lambda-{input_id}
AWS CloudWatchLogs	data-manager-cwl-{input_id}

1. Check if the HEC token has been created successfully. Each HEC token name has a Data Manager input ID in it. You can find the input_id from the URL in the Data Input Details page for that input.
2. Check if the HEC token is in enabled state. If it is disabled, enable it.
3. For CloudTrail, GuardDuty, SecurityHub, IAM Access Analyzer, and CloudWatch Logs, the HEC token must have indexer acknowledgement enabled.
4. If any HEC token is missing for an input, delete the input. To learn more about deleting an input, see the Delete Your Data Inputs chapter in this manual.