How to modify the default value for the "host" field for the events getting in via HEC

[Iris_Pi]

Hello Guys,

We are using Splunk Cloud and have created multiple HECs for different products.

We noticed that events coming in through HEC always have "xxx.splunkcloud.com" as the value of the host field. Is there a way to assign different hostnames to different products?

Thanks & Regards,
Iris

[PickleRick · Accepted solution]

What the data looks like when ingested with HEC depends on the endpoint you use.

If you're using the /raw endpoint you can include the host value as parameter

If you're using the /event endpoint you can include host field as additional field along your event

See

https://docs.splunk.com/Documentation/Splunk/9.3.0/RESTREF/RESTinput#services.2Fcollector.2Fraw

and

https://docs.splunk.com/Documentation/Splunk/9.3.0/RESTREF/RESTinput#services.2Fcollector.2Fevent

(yes, these are Splunk Enterprise docs but the HEC should work the same way in Cloud - even the docs on HEC in Cloud say these two endpoints are available).

[Iris_Pi]

Hello Pickle, thanks much for the help! I'm using the raw endpoint and I can set the host by using the host parameter now.