Splunk HTTP Event Collector (HEC)

Configuration Options

Required Options

type(required)

The component type. This is a required field for all components and tells Vector which component to use.

Type	Syntax	Default	Example
string	literal		["splunk_hec"]

Advanced Options

address(optional)

The address to accept connections on.

Type	Syntax	Default	Example
string	literal	0.0.0.0:8080

token(optional)

If supplied, incoming requests must supply this token in the Authorization header, just as a client would if it was communicating with the Splunk HEC endpoint directly. If not supplied, the Authorization header will be ignored and requests will not be authenticated.

Type	Syntax	Default	Example
string	literal		["A94A8FE5CCB19BA61C4C08"]

tls(optional)

Configures the TLS options for incoming connections.

Type	Syntax	Default	Example
hash	literal		[]

valid_tokens(optional)

If supplied, incoming requests must supply one of these tokens in the Authorization header, just as a client would if it was communicating with the Splunk HEC endpoint directly. If not supplied, the Authorization header will be ignored and requests will not be authenticated.

Type	Syntax	Default	Example
array	literal		["A94A8FE5CCB19BA61C4C08"]

How it Works

State

This component is stateless, meaning its behavior is consistent across each input.

Transport Layer Security (TLS)

Vector uses OpenSSL for TLS protocols. You can adjust TLS behavior via the tls.* options.

Context

By default, the splunk_hec source augments events with helpful context keys.