---
title: "Ingest raw Splunk HEC events"
method: POST
path: "/services/collector/raw"
tags: ["hec"]
---

# Ingest raw Splunk HEC events

`POST /services/collector/raw`

## Request

- Base URL: `https://hec.{axiom-domain}`
- URL: `https://hec.{axiom-domain}/services/collector/raw`
- Auth: OAuth 2
  - Authorization code: `https://accounts.google.com/o/oauth2/v2/auth`
  - Token URL: `https://www.googleapis.com/oauth2/v4/token` scopes: `ingest|create`
- TypeScript: <https://skmtc.dev/axiom/apis/axiom-hec/docs/services/collector/raw/post.ts> (a function with typed inputs; its response is checked against the schema)

Ingests a raw payload into an events or logs dataset. Each line of a plain-text body becomes one event. Event metadata comes from the `host`, `source`, and `sourcetype` query parameters instead of an envelope.

## Query parameters

- `index` string
- `sourcetype` string
- `source` string
- `host` string

## Request body

- string, binary: A JSON payload to ingest as a single event.

## Response `200`

The events were accepted.

- HecStatus: The Splunk HEC status envelope.
  - `text` string, required: A human-readable status message.
  - `code` integer, required: The Splunk status code. `0` indicates success, `17` indicates a healthy collector, and `5`, `6`, and `7` indicate no data, invalid data format, and incorrect index respectively.

## Other responses

- `400`: The request can't be processed. `code` is `5` (no data), `6` (invalid data format, or the dataset is in another edge deployment or isn't an events or logs dataset), or `7` (no dataset could be resolved).
- `401`: The token is missing (`code` `2`) or invalid (`code` `3`).
- `403`: The token can't ingest into the dataset, the dataset is shared, or the organization is suspended. `code` is `4`.
- `404`: Dataset not found. `code` is `7`.

## Changes

- **2026-10-16** `72333289959e`: 3 info
  - added the non-success response with the status `401`
  - added the non-success response with the status `403`
  - added the non-success response with the status `404`

[Operation history](https://skmtc.dev/axiom/apis/axiom-hec/changes/services/collector/raw/post.md)

---

[API](https://skmtc.dev/axiom/apis/axiom-hec.md) - [All operations](https://skmtc.dev/axiom/apis/axiom-hec/llms.txt) - [OpenAPI document](https://skmtc.dev/axiom/apis/axiom-hec/revisions/72333289959e?raw)