Sending logs using Splunk HEC

[cyber_castle]

Hello,

We have a requirement to send the logs from one of our IoT devices in to the Splunk. As it doesnt have syslog functionality/ install splunk agent, we are planning to use HEC.

I have gone through the Splunk documentation on HEC and created the token and did some testing using curl and everything looks good. (curl -k http://localhost:8088/services/collector -H "Authorization:Splunk " -d "{json formatted entries}").

Now what should be the next step to collect the actual logs from the device. Whether the developer needs to output the logs in to the above Splunk HEC token?

[Prewin027 · Accepted solution]

Hi,

Yes. Now using created HEC Token you can use your application to send data to Splunk HEC.

There are several options for sending data to HTTP Event Collector:

You can make an HTTP request using your favorite HTTP client and send your JSON-encoded events.
As a developer, you can use the Java, JavaScript (node.js), and .NET logging libraries in your application to send data to HEC. These libraries are compatible with popular logging frameworks.

http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE2K

http://dev.splunk.com/view/splunk-loglib-dotnet/SP-CAAAEX4