---
title: "Ingest Splunk HEC events (alias)"
method: POST
path: "/services/collector"
tags: ["hec"]
---

# Ingest Splunk HEC events (alias)

`POST /services/collector`

## Request

- Base URL: `https://hec.{axiom-domain}`
- URL: `https://hec.{axiom-domain}/services/collector`
- Auth: OAuth 2
  - Authorization code: `https://accounts.google.com/o/oauth2/v2/auth`
  - Token URL: `https://www.googleapis.com/oauth2/v4/token` scopes: `ingest|create`
- TypeScript: <https://skmtc.dev/axiom/apis/axiom-hec/docs/services/collector/post.ts> (a function with typed inputs; its response is checked against the schema)

Ingests one or more Splunk HEC event envelopes, concatenated or newline-delimited, into an events or logs dataset. The dataset comes from the `index` query parameter, then the first event's `index` field, then the token's only ingest dataset.

## Query parameters

- `index` string

## Request body

- HecEvent: A Splunk HEC event envelope.
  - `event` unknown
  - `fields` object: Additional fields merged into the event.
  - `time` string: The event timestamp, as epoch seconds, epoch milliseconds, or an RFC 3339 string. When omitted, Axiom assigns the ingest time.
  - `index` string: The dataset (Splunk index) to ingest into. The `index` query parameter takes precedence.
  - `host` string
  - `source` string
  - `sourcetype` string

## Response `200`

The events were accepted.

- HecStatus: The Splunk HEC status envelope.
  - `text` string, required: A human-readable status message.
  - `code` integer, required: The Splunk status code. `0` indicates success, `17` indicates a healthy collector, and `5`, `6`, and `7` indicate no data, invalid data format, and incorrect index respectively.

## Other responses

- `400`: The request can't be processed. `code` is `5` (no data), `6` (invalid data format, or the dataset is in another edge deployment or isn't an events or logs dataset), or `7` (no dataset could be resolved).
- `401`: The token is missing (`code` `2`) or invalid (`code` `3`).
- `403`: The token can't ingest into the dataset, the dataset is shared, or the organization is suspended. `code` is `4`.
- `404`: Dataset not found. `code` is `7`.

## Changes

- **2026-10-16** `72333289959e`: 3 info
  - added the non-success response with the status `401`
  - added the non-success response with the status `403`
  - added the non-success response with the status `404`

[Operation history](https://skmtc.dev/axiom/apis/axiom-hec/changes/services/collector/post.md)

---

[API](https://skmtc.dev/axiom/apis/axiom-hec.md) - [All operations](https://skmtc.dev/axiom/apis/axiom-hec/llms.txt) - [OpenAPI document](https://skmtc.dev/axiom/apis/axiom-hec/revisions/72333289959e?raw)