Use Observability Pipelines’ Splunk HTTP Event Collector (HEC) destination to send logs to Splunk HEC.

Setup

Set up the Splunk HEC destination and its environment variables when you set up a pipeline. The information below is configured in the pipelines UI.

Set up the destination

• Splunk HEC アドレス:
  • Observability Pipelines Worker がリッスンして、本来 Splunk インデクサー向けであるログを受信するバインドアドレスです。例えば、0.0.0.0:8088。
    注: /services/collector/event は自動的にエンドポイントに付加されます。
  • 環境変数 DD_OP_SOURCE_SPLUNK_HEC_ADDRESS に格納されます。

Set the environment variables

• Splunk HEC token:
  • The Splunk HEC token for the Splunk indexer.
  • Stored in the environment variable DD_OP_DESTINATION_SPLUNK_HEC_TOKEN.
• Base URL of the Splunk instance:
  • The Splunk HTTP Event Collector endpoint your Observability Pipelines Worker sends processed logs to. For example, https://hec.splunkcloud.com:8088.
    Note: /services/collector/event path is automatically appended to the endpoint.
  • Stored in the environment variable DD_OP_DESTINATION_SPLUNK_HEC_ENDPOINT_URL.

How the destination works

Event batching

A batch of events is flushed when one of these parameters is met. See event batching for more information.