Sending Data to Splunk Cloud Using HTTP Event Collector (HEC)

In our previous blog, we explored how to set up Splunk Cloud and index dummy data using the upload option. Now that you have your Splunk Cloud environment up and running, let’s take it a step further. In this blog, we’ll dive into the HTTP Event Collector (HEC), a powerful feature in Splunk that allows you to send data to Splunk over HTTP or HTTPS. This is particularly useful for real-time data ingestion from various sources, such as applications or cloud services. Let’s get started!

Setting Up HTTP Event Collector in Splunk Cloud

1: Enable HEC in Splunk Cloud

• Login to your Splunk Cloud dashboard.
• Navigate to the Settings menu and select Data Inputs.
  
• Click on HTTP Event Collector and then Global Settings.
  
  
• Enable the HEC by toggling the switch to Enabled.
• Click Save to apply the changes.
  

2: Create a New Token

• In the HTTP Event Collector page, click on New Token.
  
• Enter a name for your token and configure the necessary settings, such as source type and index.
  
  
• Click Next and review your settings.
• Click Finish to create the token. Make sure to copy the token value as you’ll need it to send data.
  

Important: Make sure to copy and securely store the token value. You’ll need this to authenticate when sending data to Splunk Cloud.

3: Sending Data to Splunk Cloud Using HEC

1. Prepare Your Data: Format your data as a JSON payload. Here’s an example:

   {
   'event': 'Hello, world!',
   'sourcetype': 'sourcetype-test',
   'index': 'your_index'
   }
   

2. Send Data Using cURL: Use the following cURL command to send data to Splunk

   curl --location "https://<splunk-cloud-url>:8088/services/collector/event" --header "Authorization: Splunk <your-token>" --header "Content-Type: application/json" --data "{\"event\": \"Hello, world!\", \"sourcetype\": \"sourcetype-test\", \"index\": \"<your-index>\"}" -k

Replace <your-splunk-cloud-url> with your actual Splunk Cloud URL and <your-token> with the token you created earlier.

4: Verifying Data in Splunk Cloud

Choosing a Global Software Development Partner to Accelerate Your Digital Strategy

To be successful and outpace the competition, you need a software development partner that excels in exactly the type of digital projects you are now faced with accelerating, and in the most cost effective and optimized way possible.

Get the Guide

After sending data via HEC, it’s crucial to verify that it has been successfully indexed in Splunk Cloud.

• Log in to your Splunk Cloud dashboard.
• Use the search bar to query your indexed data. For example, you can search for index=”logs”.
  

By following these steps, you’ve successfully set up the HTTP Event Collector in Splunk Cloud and sent data using Curl. This powerful feature allows you to seamlessly integrate data from various sources in real-time, making it easier to monitor and analyze your data streams.