HEC Endpoint

[maheshnc]

I wan to ingest data from a web application using HEC, but I don't understand where can I get the endpoint URL details, also where can I create a HEC token( SH or HF)? and how can I set the sourcetype. 

Thanks in advance.

[PrewinThomas]

@maheshnc 

Where to Create the HEC Token (SH or HF?)
As a best practice, Search Heads are built primarily for querying, searching, and visualization—not for data ingestion. However, in specialized environments, this behavior may depend on your architecture or requirements.

A Heavy Forwarder is ideal for HEC-It can receive HEC data, parse it, and forward it to indexers.

Create token and sourcetype - Settings > Data Inputs > HTTP Event Collector

You can follow below doc,
#https://docs.splunk.com/Documentation/Splunk/9.4.2/Data/UsetheHTTPEventCollector

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[maheshnc]

Earlier I used to work on Splunk cloud, where we used to create a token on SH and provide the endpoint, Now I moved to Enterprise, so wanted to know if I can directly create token on indexer(master or peer node?) then provide the host as indexr in endpoint url. Please respond.

[richgalloway · Accepted solution]

Since Splunk Cloud users do not have access to the indexers, it automatically transfers HEC tokens from the SH to the indexers.  That does not happen in Splunk Enterprise - you must define the tokens on the indexers or HFs.  Then use the indexer or HF in the HEC URL.

[maheshnc]

We are having an indexer cluster (2 nodes and 1 CM) in this case do need to create HEC token on both the indexers?

[richgalloway]

If both indexers will be receiving HEC data (very likely) then both must have the same set of HEC tokens.  Do that by putting the tokens in the inputs.conf file in an app on the CM and deploying it in the cluster bundle.

[maheshnc]

Understood! Thank you so much for your response.

[richgalloway]

Start with the docs at https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.0/get-data-with-http-event-c....  It's labeled version 10, but should apply to 9.x pretty well.

The endpoint URL is derived from your HF or indexer URL.

https://mysplunkserver.example.com:8088/services/collector

Details are in the docs.

The sourcetype is specified in the HEC request, again, details in the docs.  https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.0/get-data-with-http-event-c...