HEC Endpoint

[maheshnc]

I wan to ingest data from a web application using HEC, but I don't understand where can I get the endpoint URL details, also where can I create a HEC token( SH or HF)? and how can I set the sourcetype. 

Thanks in advance.

[PrewinThomas]

@maheshnc 

Where to Create the HEC Token (SH or HF?)
As a best practice, Search Heads are built primarily for querying, searching, and visualization—not for data ingestion. However, in specialized environments, this behavior may depend on your architecture or requirements.

A Heavy Forwarder is ideal for HEC-It can receive HEC data, parse it, and forward it to indexers.

Create token and sourcetype - Settings > Data Inputs > HTTP Event Collector

You can follow below doc,
#https://docs.splunk.com/Documentation/Splunk/9.4.2/Data/UsetheHTTPEventCollector

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[richgalloway]

Start with the docs at https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.0/get-data-with-http-event-c....  It's labeled version 10, but should apply to 9.x pretty well.

The endpoint URL is derived from your HF or indexer URL.

https://mysplunkserver.example.com:8088/services/collector

Details are in the docs.

The sourcetype is specified in the HEC request, again, details in the docs.  https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.0/get-data-with-http-event-c...