--- title: Splunk HEC Logs slug: telemetry-pipeline/splunk-hec-logs docTags: createdAt: 2025-04-21T01:03:31.283Z --- # Splunk HEC Logs Sink (splunk\_hec\_logs) Delivers log events to **Splunk HTTP Event Collector (HEC)** using HTTP(S). This sink supports **at-least-once delivery**, **batching**, **buffering**, and **Splunk indexer acknowledgements**. ## Core Sink Configuration ### endpoint **Required** Base URL of the Splunk instance. - Must include scheme (http or https) - Do **not** include API paths - worker appends /services/collector internally **Example** :::BlockQuote endpoint = "https\://http-inputs-hec.splunkcloud.com" ::: ### endpoint\_target **Optional** Controls which Splunk HEC endpoint is used. | Option | Description | | ------ | --------------------------------- | | event | Sends structured events (default) | | raw | Sends raw text events | **Default** :::BlockQuote event ::: **Notes** - raw ignores structured metadata like host, index, sourcetype - event is recommended for most use cases ### default\_token **Required** The Splunk HEC authentication token. - Used unless an event overrides it via splunk\_hec\_token secret - Sent as Authorization: Splunk \ ## ### ## Batching (batch) Controls how events are grouped before sending. ### batch.max\_bytes **Optional (uint)** Maximum uncompressed batch size in bytes. **Default** :::BlockQuote 1\_000\_000 ::: ### batch.max\_events **Optional (uint)** Maximum number of events per batch. ### batch.timeout\_secs **Optional (float)** Maximum time to wait before flushing a batch. **Default** :::BlockQuote 1 ::: ## Buffering (buffer) Handles temporary storage when downstream is slow or unavailable. ### buffer.type **Optional** | Option | Description | | ------ | ------------------------ | | memory | Fast, volatile (default) | | disk | Durable, slower | **Default** :::BlockQuote memory ::: ### buffer.max\_events **Optional** Maximum events stored in memory buffer. **Default** :::BlockQuote 500 ::: ### buffer.max\_size **Required** Maximum total buffer size in bytes. - Disk buffers must be ≥ \~256MB ### buffer.when\_full **Optional** | Option | Description | | ------------ | ---------------------------- | | block | Apply backpressure (default) | | drop\_newest | Drop incoming events | ## Compression (compression) Controls HTTP payload compression. | Option | Description | | ------ | ------------------------ | | none | No compression (default) | | gzip | Gzip | | snappy | Snappy | | zlib | Zlib | | zstd | Zstandard | ## Encoding (encoding) Defines how events are serialized before sending. ### encoding.codec **Required** | Codec | Description | | ------------ | --------------------------------- | | json | JSON-encoded events (most common) | | text | Raw message field | | cef | Common Event Format | | csv | CSV output | | gelf | GELF format | | avro | Apache Avro | | protobuf | Protobuf | | raw\_message | Message field only | ### encoding.only\_fields **Optional** Whitelist of fields to include. ### encoding.except\_fields **Optional** Blacklist of fields to exclude. ### encoding.timestamp\_format **Optional** | Option | Description | | -------- | ------------ | | rfc3339 | ISO format | | unix | Seconds | | unix\_ms | Milliseconds | | unix\_us | Microseconds | | unix\_ns | Nanoseconds | ### encoding.json.pretty **Optional (bool)** Pretty-print JSON output. **Default** :::BlockQuote false ::: ## Splunk Metadata Mapping ### index **Optional (template)** Target Splunk index. - Supports dynamic per-event templates **Example** :::BlockQuote index = "\{\{ service }}" ::: ### source **Optional (template)** Logical source of the event (e.g., filename, service). ### sourcetype **Optional (template)** Splunk sourcetype. **Default** :::BlockQuote httpevent ::: ### host\_key **Optional** Overrides which event field is used as Splunk host. ### timestamp\_key **Optional** Overrides timestamp field. - Set to empty string ("") to omit timestamps entirely ### indexed\_fields **Optional** List of fields added to Splunk’s indexed metadata. ## HTTP Request Behavior (request) Controls retries, rate limiting, and concurrency. ### request.concurrency **Optional** | Option | Description | | --------- | ----------------------------- | | adaptive | Dynamic concurrency (default) | | none | Single request at a time | | \ | Fixed concurrency | ### request.timeout\_secs **Optional** Request timeout. **Default** :::BlockQuote 60 seconds ::: ### request.retry\_attempts **Optional** Maximum retry count. ### request.retry\_initial\_backoff\_secs **Optional** Initial retry delay. ### request.retry\_max\_duration\_secs **Optional** Maximum backoff delay. ### request.retry\_jitter\_mode **Optional** | Option | Description | | ------ | -------------------------- | | Full | Randomized delay (default) | | None | No jitter | ### request.rate\_limit\_num **Optional** Max requests per time window. ### request.rate\_limit\_duration\_secs **Optional** Rate-limit window size. ## Proxy (proxy) Controls outbound HTTP proxy usage. ### proxy.enabled **Optional** :::BlockQuote true ::: ### proxy.http / proxy.https **Optional** Proxy endpoint URIs. ### proxy.no\_proxy **Optional** Hosts excluded from proxying. ## TLS (tls) Controls secure transport. ### tls.enabled **Optional** Enables TLS. ### tls.verify\_certificate **Optional** Enables certificate validation. ### tls.verify\_hostname **Optional** Enables hostname verification. ### tls.ca\_file **Optional** Custom CA bundle. ### tls.crt\_file / tls.key\_file **Optional** Client certificate and private key.