Splunk HEC receiver 🔗
The Splunk HTTP Event Collector (HEC) receiver allows the Splunk Distribution of OpenTelemetry Collector to collect events and logs in Splunk HEC format. The supported pipeline types are
logs. See Process your data with pipelines for more information.
The receiver accepts data formatted as JSON HEC events under any path or as end-of-line separated log raw data if sent to the
raw_path. See Format events for HTTP Event Collector for more information.
For information about the HEC exporter, see Splunk HEC exporter.
Get started 🔗
Follow these steps to configure and activate the component:
Deploy the Splunk Distribution of OpenTelemetry Collector to your host or container platform:
Configure the Splunk HEC receiver as described in the next section.
Restart the Collector.
Sample configurations 🔗
To activate the Splunk HEC receiver add a
splunk_hec entry inside the
receivers section of the Collector configuration file. For example:
The following example shows a Splunk HEC receiver configured with all available settings:
receivers: # ... splunk_hec: # Address and port the Splunk HEC receiver should bind to endpoint: localhost:8088 # Whether to preserve incoming access token access_token_passthrough: true # Path accepting raw HEC events (logs only) raw_path: "/foo" # Path reporting health checks health_path: "/bar" # Define field mappings hec_metadata_to_otel_attrs: source: "file.name" sourcetype: "foobar" index: "myindex" host: "myhostfield" # Optional TLS settings tls: # Both cert_file and # key_file are required # for TLS connections cert_file: /test.crt key_file: /test.key
The following table shows the configuration options for the Splunk HEC receiver:
If you are a Splunk Observability Cloud customer and are not able to see your data in Splunk Observability Cloud, you can get help in the following ways.
Available to Splunk Observability Cloud customers
Available to prospective customers and free trial users
Ask a question and get answers through community support at Splunk Answers .
Join the Splunk #observability user group Slack channel to communicate with customers, partners, and Splunk employees worldwide. To join, see Chat groups in the Get Started with Splunk Community manual.
To learn about even more support options, see Splunk Customer Success .