Splunk

Observability

Synopsis

Creates a Splunk HTTP Event Collector (HEC) target that sends events to one or more Splunk instances. Supports batching, compression, field normalization, and automatic load balancing across multiple endpoints.

Schema

- name: <string>
  description: <string>
  type: splunk
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    endpoints:
      - endpoint: <string>
        auth_type: <string>
        token: <string>
        secret: <string>
    index: <string>
    source_type: <string>
    source: <string>
    batch_size: <numeric>
    timeout: <numeric>
    tcp_routing: <boolean>
    use_compression: <boolean>
    insecure_skip_verify: <boolean>
    ca_name: <string>
    server_name: <string>
    cert_name: <string>
    key_name: <string>
    passphrase: <string>
    min_tls_version: <string>
    max_tls_version: <string>
    field_format: <string>
    debug:
      status: <boolean>
      dont_send_logs: <boolean>

Configuration

The following are the fields used to define the target:

Field	Required	Default	Description
name	Y		Target name
description	N	-	Optional description
type	Y		Must be splunk
pipelines	N	-	Optional post-processor pipelines
status	N	true	Enable/disable the target

Endpoint

Field	Required	Default	Description
endpoint	Y	-	Splunk HEC endpoint URL
auth_type	N	token	Authentication type: token or secret
token	Y*	-	HEC token when using token auth
secret	Y*	-	Bearer token when using secret auth
max_bytes	N	4194304 (4 MB)	Maximum size of a single request body or batch, in bytes

note

max_bytes caps the size of a single request body or batch. It behaves differently from max_size on the file-writing targets, and the difference is easy to get wrong:

• An explicit max_bytes: 0 IS honoured and removes the ceiling. The value is read with Int64, which returns what you wrote — unlike max_size, which is read with MustInt64 and silently substitutes its default for a zero.
• A negative value is rejected at configuration time with max_bytes must not be negative.

The ceiling is validated when the target is built and enforced again on every batch, so a value the receiving service will refuse fails early rather than per request.

* = token is required when auth_type is token; secret is required when auth_type is secret.

Event

Field	Required	Default	Description
index	N	-	Default Splunk index
source_type	N	-	Default sourcetype for events
source	N	-	Default source for events
batch_size	N	10000	Number of events to batch before sending
timeout	N	30	Connection timeout in seconds

Connection

Field	Required	Default	Description
tcp_routing	N	false	Enable TCP routing header
use_compression	N	true	Enable gzip compression
field_format	N	-	Data normalization format. See applicable Normalization section

TLS

TLS is engaged by the endpoint URL scheme: an https:// endpoint enables it, an http:// endpoint does not. There is no status field. The fields below are top-level, at the root of properties.

The web interface exposes only insecure_skip_verify for these targets. Every other field below — the CA bundle, the client certificate and key, the SNI override and the version bounds — has to be set in the YAML configuration or through the API; there is no form control for it.

Field	Required	Default	Description
insecure_skip_verify	N	false	Skip server certificate verification. Use only for testing.
ca_name	N	-	CA bundle used to verify the server certificate. When unset, the host trust store is used; when set, it replaces the host trust store rather than adding to it.
server_name	N	-	SNI hostname override for the TLS handshake
cert_name	N*	-	Client certificate for mutual TLS
key_name	N*	-	Client private key for mutual TLS
passphrase	N	-	Passphrase for an encrypted private key
min_tls_version	N	tls1.2	Minimum accepted TLS version (tls1.0, tls1.1, tls1.2, tls1.3)
max_tls_version	N	tls1.3	Maximum accepted TLS version (tls1.0, tls1.1, tls1.2, tls1.3)

* = Mutual TLS requires both cert_name and key_name. Setting only one is a configuration error.

note

A nested tls: block is also accepted, and a non-empty one replaces the flat shape rather than merging with it: the sender reads the block and ignores every flat key, including options the block leaves out. Use one shape or the other, never a mixture.

insecure_skip_verify is the single exception. It is read from the nested block when present and otherwise falls back to the root, so a target carrying a hand-written tls: block keeps the skip-verify its form wrote. Only an absent nested value falls through — a nested false is an explicit statement and overrides a root true.

There is no tls.status: TLS is off when the whole block is absent, and a status key inside the block is not read.

note

TLS material fields (cert_name, key_name, ca_name, client_ca_name) accept any of the following:

• File name — resolved relative to the service root directory. Nested paths such as certs/prod/server.pem are supported.
• Absolute path — honored only if it resolves inside the service root. Any path that escapes the root is refused.
• Inline PEM content — used verbatim when the value contains -----BEGIN.
• Environment variable — ${ENV_VAR}.
• Vault reference — $secret{id=...} or $secret{store=...,ref=...}.

Scheduling

See Scheduling and Pool Behavior for interval and cron fields shared by all targets.

Debug Options

Field	Required	Default	Description
debug.status	N	false	Enable debug logging
debug.dont_send_logs	N	false	Process logs but don't send to target (testing)

Details

The Splunk HEC target sends log data to Splunk using the HTTP Event Collector (HEC) protocol. It supports multiple authentication methods, batching, compression, and automatic load balancing between endpoints.

The crowdstrike target type shares this implementation and uses the identical YAML schema. See CrowdStrike Falcon Next-Gen SIEM.

warning

Ensure your HEC tokens have the appropriate permissions and indexes enabled in Splunk. Invalid tokens or insufficient permissions will result in ingestion failures.

Events are automatically batched and compressed by default for optimal performance. When multiple endpoints are configured, the target randomly selects an endpoint for each batch to distribute load evenly across all available Splunk instances.

warning

Setting insecure_skip_verify to true is not recommended for production environments.

HEC Modes: JSON and RAW

The target supports both JSON and RAW HEC ingestion modes. The mode is determined by the endpoint URL path, not by a separate configuration field.

An endpoint URL ending in /services/collector/event (or the default /services/collector) uses JSON mode, where each event is sent as a structured JSON object with metadata fields (index, sourcetype, source) embedded in the payload.

An endpoint URL ending in /services/collector/raw uses RAW mode, where events are sent as plain text with metadata passed as query parameters. RAW mode is useful for forwarding pre-formatted log lines that should not be wrapped in JSON structure. When the incoming pipeline data contains a _raw field, the target extracts its value and sends it as the raw event body.

Named Streams

Endpoint URLs can include a query parameter to define a named stream. For example, https://hec.example.com:8088/services/collector/raw?paloalto creates a stream named paloalto using RAW mode, while https://hec.example.com:8088/services/collector/event?winevent creates a stream named winevent using JSON mode.

Named streams allow routing different event types through separate HEC paths within a single target configuration. A pipeline selects the stream for an event by setting index or table.

Events carrying neither are delivered to the endpoint configured without a query parameter, which acts as the catch-all stream. An event naming a stream that no endpoint defines also falls back to the catch-all; if no catch-all exists, the event is rejected.

All endpoints sharing a stream name must use the same mode. Mixing a /raw endpoint and an /event endpoint under one stream is a configuration error and the target fails to initialize.

Load Balancing and Failover

When multiple endpoints are configured, the target uses randomized load balancing. For each batch:

1. Endpoints are randomly shuffled
2. The batch is sent to the first endpoint
3. If it fails, the next endpoint in the shuffled list is tried
4. This continues until successful delivery or all endpoints fail

If only some endpoints fail but delivery eventually succeeds, the batch is cleared and a partial error is logged. If all endpoints fail, the batch is retained for retry and a complete failure error is returned.

Dynamic Routing

Pipeline processors can override the sourcetype and select the delivery stream on a per-event basis:

• Setting schema or source in a pipeline overrides the sourcetype for that event. When both are set, schema wins.
• Setting index or table in a pipeline selects the named stream the event is delivered to, as described above. It does not change the index value embedded in the JSON payload.

The index and source values sent to Splunk are always taken from the target's own properties and cannot be overridden per event.

Example pipeline configuration:

pipelines:
  - name: route_by_severity
    processors:
      - set:
          field: schema
          value: "app:error"
          if: "severity == 'error'"
      - set:
          field: index
          value: "critical"
          if: "severity == 'critical'"

Events matching the second condition are delivered to the stream named critical, which requires an endpoint configured with ?critical. Events that match no stream fall back to the endpoint configured without a query parameter.

Compression

Compression is enabled by default and uses gzip to reduce network bandwidth. This adds minimal CPU overhead but can significantly improve throughput for high-volume scenarios. Disable compression only if you have bandwidth to spare and want to reduce CPU usage.

Field Normalization

Field normalization helps standardize log data before sending it to Splunk, ensuring consistent data formats that can be easily correlated:

• cim - Common Information Model

Normalization is applied before batching and sending to Splunk.

Examples

Basic

Send events to a single HEC endpoint...

targets: - name: basic_splunk type: splunk properties: endpoints: - endpoint: "https://splunk.example.com:8088/services/collector" auth_type: token token: "YOUR-HEC-TOKEN" index: "main" source_type: "vmetric"

Load Balanced

Configure load balancing and failover across multiple endpoints...

targets: - name: ha_splunk type: splunk properties: endpoints: - endpoint: "https://splunk1.example.com:8088/services/collector" auth_type: token token: "PRIMARY-TOKEN" - endpoint: "https://splunk2.example.com:8088/services/collector" auth_type: token token: "BACKUP-TOKEN" - endpoint: "https://splunk3.example.com:8088/services/collector" auth_type: token token: "TERTIARY-TOKEN" index: "main" source_type: "vmetric" batch_size: 5000

High-Volume

Configure for high throughput with larger batches and extended timeout...

targets: - name: perf_splunk type: splunk properties: endpoints: - endpoint: "https://splunk.example.com:8088/services/collector" auth_type: token token: "YOUR-HEC-TOKEN" index: "metrics" source_type: "vmetric" batch_size: 20000 timeout: 60 use_compression: true tcp_routing: true

With Field Normalization

Using CIM field normalization for better Splunk integration...

targets: - name: normalized_splunk type: splunk properties: endpoints: - endpoint: "https://splunk.example.com:8088/services/collector" auth_type: token token: "YOUR-HEC-TOKEN" index: "main" source_type: "normalized_logs" field_format: "cim"

Secure

Using secret-based auth with TLS verification and custom source...

targets: - name: secure_splunk type: splunk properties: endpoints: - endpoint: "https://splunk.example.com:8088/services/collector" auth_type: secret secret: "YOUR-BEARER-TOKEN" index: "secure" source_type: "vmetric" source: "production_cluster" insecure_skip_verify: false use_compression: true

RAW Mode

Send raw log lines using HEC RAW mode with a named stream...

targets: - name: raw_splunk type: splunk properties: endpoints: - endpoint: "https://splunk.example.com:8088/services/collector/raw?firewall" auth_type: token token: "YOUR-HEC-TOKEN" index: "network" source_type: "paloalto:traffic" source: "pan-fw-01"

No Compression

Disable compression to reduce CPU overhead when bandwidth is not a concern...

targets: - name: uncompressed_splunk type: splunk properties: endpoints: - endpoint: "https://splunk.example.com:8088/services/collector" auth_type: token token: "YOUR-HEC-TOKEN" index: "main" source_type: "vmetric" use_compression: false