https://community.splunk.com/t5/Getting-Data-In/forwarding-baked-HEC-traffic-between-two-Splunk-Entreprise/m-p/619265#M106783 <P>Hello,</P><P>I would like to forward data between two splunk instances in clear text. For that I use HEC. This is my outputs.conf .&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">[httpout] httpEventCollectorToken = &lt;HEC_TOKEN&gt; uri = http://hec_target:8088</LI-CODE><P>&nbsp;</P><P>I would like to inspect the events with a third party application, but they appear to be encoded in s2s. Also this configuration sends the events to the /services/collector/s2s endpoint, which is not the same one would forward clear text (JSON) events to. Is there any way to send the events in a readable format?</P><P>I am aware there is syslog output. I would try it if there is no possibility to change the HEC output accordingly.&nbsp;</P><P>Thanks in advance.</P> Wed, 02 Nov 2022 11:14:46 GMT Brainizer 2022-11-02T11:14:46Z https://community.splunk.com/t5/Getting-Data-In/forwarding-baked-HEC-traffic-between-two-Splunk-Entreprise/m-p/619265#M106783 <P>Hello,</P><P>I would like to forward data between two splunk instances in clear text. For that I use HEC. This is my outputs.conf .&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">[httpout] httpEventCollectorToken = &lt;HEC_TOKEN&gt; uri = http://hec_target:8088</LI-CODE><P>&nbsp;</P><P>I would like to inspect the events with a third party application, but they appear to be encoded in s2s. Also this configuration sends the events to the /services/collector/s2s endpoint, which is not the same one would forward clear text (JSON) events to. Is there any way to send the events in a readable format?</P><P>I am aware there is syslog output. I would try it if there is no possibility to change the HEC output accordingly.&nbsp;</P><P>Thanks in advance.</P> Wed, 02 Nov 2022 11:14:46 GMT https://community.splunk.com/t5/Getting-Data-In/forwarding-baked-HEC-traffic-between-two-Splunk-Entreprise/m-p/619265#M106783 Brainizer 2022-11-02T11:14:46Z