---
title: "Ingest logs via Splunk HEC format"
method: POST
path: "/api/{org_id}/_hec"
tags: ["Logs"]
---

# Ingest logs via Splunk HEC format

`POST /api/{org_id}/_hec`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/{org_id}/_hec`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/:org_id/_hec/post.ts> (a function with typed inputs; its response is checked against the schema)

Ingests log data using Splunk HTTP Event Collector (HEC) format, providing compatibility with Splunk forwarders and applications. This endpoint accepts the standard HEC JSON format, making it easy to migrate from or integrate with existing Splunk deployments.

## Path parameters

- `org_id` string, required

## Request body `text/plain`

- string

## Response `200`

Failure

- object
  - `code` integer, required
  - `text` string, required

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)