hec

Ingest Splunk HEC events

Changed on Oct 16, 2026

Ingests one or more Splunk HEC event envelopes, concatenated or newline-delimited, into an events or logs dataset. The dataset comes from the index query parameter, then the first event's index field, then the token's only ingest dataset.

post/services/collector/event

Request

Base URL
https://hec.{axiom-domain}
Auth
OAuth 2
Authorization codehttps://accounts.google.com/o/oauth2/v2/auth
Token URLhttps://www.googleapis.com/oauth2/v4/token
Scopesingest|create
TypeScript
https://skmtc.dev/axiom/apis/axiom-hec/docs/services/collector/event/post.ts
A function with typed inputs. Its response is checked against the schema.

Query parameters

indexstring

The dataset (Splunk index) to ingest into. Overrides the index field in the event envelope.

Request body

eventunknown

fieldsobject

Additional fields merged into the event.

timestring

The event timestamp, as epoch seconds, epoch milliseconds, or an RFC 3339 string. When omitted, Axiom assigns the ingest time.

indexstring

The dataset (Splunk index) to ingest into. The index query parameter takes precedence.

hoststring

sourcestring

sourcetypestring

Example request

{
  "event": {
    "message": "hello from HEC",
    "severity": "INFO"
  },
  "sourcetype": "httpevent"
}

Response

The events were accepted.

textstring required

A human-readable status message.

codeinteger required

The Splunk status code. 0 indicates success, 17 indicates a healthy collector, and 5, 6, and 7 indicate no data, invalid data format, and incorrect index respectively.

Example response

{
  "text": "Success"
}

Changes

Oct 16, 202672333289959e Revision changes
- info
  added the non-success response with the status
- info
  added the non-success response with the status
- info
  added the non-success response with the status

Operation history