capabilities.work

HEC Ingest an Event and Confirm Indexing

A 3-step recipe with Splunk. We can help you get access.

Recipe · 3 steps

HEC Ingest an Event and Confirm Indexing

with Splunk

Create an ack-enabled HEC token, send a JSON event, and confirm indexing.

  1. Create a HEC token with indexer acknowledgment enabled so that ingested events can be tracked through to indexing.
  2. Post a structured JSON event to the HTTP Event Collector using the HEC token, capturing the acknowledgment ID for the batch.
  3. Query the indexer acknowledgment endpoint with the ackId and poll until the event reports as indexed.
What you'll need to have ready
  • tokenName: Name for the new HEC token to create.
  • index: Default destination index for the token and event.
  • sourcetype: Source type to assign to the ingested event.
  • hecAuthorization: The HEC Authorization header value for the collector calls, formatted as "Splunk <token>".
  • event: The event payload to ingest.
  • host: Host value to assign to the event.
For your developer

Arazzo workflow splunk:hec-ingest-and-acknowledge, 3 operations: createHttpInputToken → sendEvent → checkAckStatus. Specs on APIs.io.

More recipes with Splunk

Finalize, Read, and Clean Up a Search JobProvision an Index and Attach a Monitor InputIngest Raw Data then Search for ItRun a Search Job and Retrieve ResultsSearch and Retrieve Raw Events