{"id":"528dc637-3b0d-4dc6-bfb4-2489d95b3597","task":"Configure Splunk HEC ingestion and send log events","domain":"docs.splunk.com","steps":["Enable the HTTP Event Collector in Splunk Web under Settings > Data Inputs > HTTP Event Collector; create a new token, assign it to the target index and a source type, and copy the generated token value","Send events by POSTing JSON to https://YOUR_SPLUNK_HOST:8088/services/collector/event with header Authorization: Splunk YOUR_HEC_TOKEN and body {\"event\": \"your log line\", \"sourcetype\": \"myapp\", \"index\": \"main\"}","Use the raw endpoint /services/collector/raw for sending newline-delimited plain text in bulk without JSON wrapping; the sourcetype and index are set by token configuration or query-parameter overrides","Batch multiple events in a single POST by concatenating JSON event objects (no array wrapper or commas between objects); HEC accepts up to 1 MB per request by default—this limit is configurable","Enable indexer acknowledgment on the token if you need at-least-once delivery: include the header X-Splunk-Request-Channel with a unique UUID, then poll /services/collector/ack with the returned ackId list to confirm indexing","For Splunk Cloud Platform, create HEC tokens via the Admin Config Service (ACS) API rather than Splunk Web UI to support automation and GitOps workflows"],"gotchas":["HEC tokens are not scoped to sourcetype at the API level—a sender can override sourcetype per request; restrict to expected sourcetypes by enabling sourcetype allowlists in the token configuration","A 503 response from HEC means the indexer queue is full (the server is busy); implement exponential-backoff retry logic in your log shipper rather than dropping events on 503","The event timestamp defaults to ingest time if the time field is omitted; always include \"time\": UNIX_EPOCH_SECONDS in each event object to preserve the original event timestamp for accurate time-ordered search"],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:37.008Z"},"url":"https://mcp.waymark.network/r/528dc637-3b0d-4dc6-bfb4-2489d95b3597"}