AXaxiom
hec

Ingest raw Splunk HEC events

Changed on

Ingests a raw payload into an events or logs dataset. Each line of a plain-text body becomes one event. Event metadata comes from the host, source, and sourcetype query parameters instead of an envelope.

post/services/collector/raw

Request

Query parameters

indexstring

The dataset (Splunk index) to ingest into.

sourcetypestring

The sourcetype to attach to every event in the request.

sourcestring

The source to attach to every event in the request.

hoststring

The host to attach to every event in the request.

Request body

string binary required

A JSON payload to ingest as a single event.

Response

The events were accepted.

textstring required

A human-readable status message.

codeinteger required

The Splunk status code. 0 indicates success, 17 indicates a healthy collector, and 5, 6, and 7 indicate no data, invalid data format, and incorrect index respectively.

Example response

{
  "text": "Success"
}

Changes

  • 72333289959eRevision changes
    • info

      added the non-success response with the status

    • info

      added the non-success response with the status

    • info

      added the non-success response with the status