topic Re: HEC Endpoint in Getting Data In

HEC Endpoint

maheshnc — Mon, 08 Sep 2025 16:02:54 GMT

I wan to ingest data from a web application using HEC, but I don't understand where can I get the endpoint URL details, also where can I create a HEC token( SH or HF)? and how can I set the sourcetype.

Thanks in advance.

Re: HEC Endpoint

richgalloway — Mon, 08 Sep 2025 17:48:20 GMT

Start with the docs at https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.0/get-data-with-http-event-collector/share-hec-data. It's labeled version 10, but should apply to 9.x pretty well.

The endpoint URL is derived from your HF or indexer URL.

https://mysplunkserver.example.com:8088/services/collector

Details are in the docs.

The sourcetype is specified in the HEC request, again, details in the docs. https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.0/get-data-with-http-event-collector/format-events-for-http-event-collector

Re: HEC Endpoint

PrewinThomas — Tue, 09 Sep 2025 04:14:33 GMT

@maheshnc

Where to Create the HEC Token (SH or HF?)
As a best practice, Search Heads are built primarily for querying, searching, and visualization—not for data ingestion. However, in specialized environments, this behavior may depend on your architecture or requirements.

A Heavy Forwarder is ideal for HEC-It can receive HEC data, parse it, and forward it to indexers.

Create token and sourcetype - Settings > Data Inputs > HTTP Event Collector

You can follow below doc,
#https://docs.splunk.com/Documentation/Splunk/9.4.2/Data/UsetheHTTPEventCollector

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: HEC Endpoint

maheshnc — Thu, 11 Sep 2025 11:40:41 GMT

Earlier I used to work on Splunk cloud, where we used to create a token on SH and provide the endpoint, Now I moved to Enterprise, so wanted to know if I can directly create token on indexer(master or peer node?) then provide the host as indexr in endpoint url. Please respond.

Re: HEC Endpoint

richgalloway — Thu, 11 Sep 2025 12:00:02 GMT

Since Splunk Cloud users do not have access to the indexers, it automatically transfers HEC tokens from the SH to the indexers. That does not happen in Splunk Enterprise - you must define the tokens on the indexers or HFs. Then use the indexer or HF in the HEC URL.

Re: HEC Endpoint

maheshnc — Thu, 11 Sep 2025 12:09:18 GMT

Understood! Thank you so much for your response.

Re: HEC Endpoint

maheshnc — Tue, 18 Nov 2025 10:06:18 GMT

We are having an indexer cluster (2 nodes and 1 CM) in this case do need to create HEC token on both the indexers?

Re: HEC Endpoint

richgalloway — Tue, 18 Nov 2025 12:55:21 GMT

If both indexers will be receiving HEC data (very likely) then both must have the same set of HEC tokens. Do that by putting the tokens in the inputs.conf file in an app on the CM and deploying it in the cluster bundle.