Splunk HEC Sink Node
Quick Reference
In Destination, choose Asset Type and Asset Name, then open Configure Pipeline Settings. The fields listed here are the complete set of editable inputs for this Destination type, subject to the stated visibility conditions.
- Asset Type: Choose a Data Asset; UI selection determines the sink type on Save.
- Asset Name: Choose a Data Asset; reference to the selected data asset.
- Source: Configure Pipeline Settings.
- Sourcetype: Configure Pipeline Settings.
- Batch Size: Configure Pipeline Settings.
- Verify SSL Certificates: Configure Pipeline Settings.
| Resource | Settings owned there |
|---|---|
| Node (Destination) | Source, Sourcetype, Batch Size, Verify SSL Certificates; Asset Type and Asset Name select the referenced asset. |
| Data asset | HEC URL and Index. |
| Connection profile (API Key) | HEC token. The asset links to this profile; it does not own the token. |
In Data Assets → Asset Information → Edit, existing Index and Verify SSL Certificates properties can be updated with Save → Save Changes. The HEC URL input is visible, but Save rejects a changed HEC URL. For a different endpoint, create a replacement asset, select it in Asset Name, then Save. To change the token, click the profile name in the asset's Connection Profile card in Data Assets. The API Key profile opens in Settings → Connection Profiles, where its owner can change the API Key with Edit in Configuration. API Key profiles are not listed on that page, so open them from the asset.
Configuration
Configuration keys below are relative to the node configuration. Use the field name in the panel when following instructions in the builder; required markers such as an asterisk are not part of the name.
Destination panel
Choose Asset Type and Asset Name first. Type-specific inputs appear in Configure Pipeline Settings after an asset is selected; an asset error can prevent that section from appearing. A missing or unavailable asset is a reference problem, not proof that the connector does not exist.
The fields listed here are the complete set of editable inputs for this Destination type, subject to the stated visibility conditions.
| Field in the panel | Configuration key | Where to edit / when shown |
|---|---|---|
| Asset Type | UI only; no separate config key | Choose a Data Asset; UI selection determines the sink type on Save |
| Asset Name | dataAssetId | Choose a Data Asset; reference to the selected data asset |
| Source | source | Configure Pipeline Settings — Value assigned to the record's source field (e.g. fleak). Required: No. |
| Sourcetype | sourcetype | Configure Pipeline Settings — Value assigned to the record's sourcetype field (e.g. _json). Required: No. |
| Batch Size | batchSize | Configure Pipeline Settings; required to save Destination — Number of records sent in a single HEC request. Default: 500. Required: Yes. |
| Verify SSL Certificates | verifySsl | Configure Pipeline Settings — Validate the Splunk endpoint's TLS certificate. Turn off only for self-signed development clusters. Default: true. Required: No. |
| Resource | Settings owned there |
|---|---|
| Node (Destination) | Source, Sourcetype, Batch Size, Verify SSL Certificates; Asset Type and Asset Name select the referenced asset. |
| Data asset | HEC URL and Index. |
| Connection profile (API Key) | HEC token. The asset links to this profile; it does not own the token. |
In Data Assets → Asset Information → Edit, existing Index and Verify SSL Certificates properties can be updated with Save → Save Changes. The HEC URL input is visible, but Save rejects a changed HEC URL. For a different endpoint, create a replacement asset, select it in Asset Name, then Save. To change the token, click the profile name in the asset's Connection Profile card in Data Assets. The API Key profile opens in Settings → Connection Profiles, where its owner can change the API Key with Edit in Configuration. API Key profiles are not listed on that page, so open them from the asset.
Legacy panel
In the asset-managed legacy panel, Sourcetype and Verify SSL Certificates are read-only; Source and Batch Size remain editable.
Use this section only when the workflow opens the legacy editor. Asset-managed connection values can be read-only; see Managing Data Assets for available edits and the replacement-asset flow.
| Field in the panel | Configuration key | Where to edit / when shown |
|---|---|---|
| Splunk Credential | credentialId | Legacy panel; read-only when dataAssetId is set, because the linked API Key connection profile supplies the credential |
| HEC URL | hecUrl | Legacy panel; read-only when dataAssetId is set, because the selected data asset supplies this value |
| Index | index | Legacy panel; read-only when dataAssetId is set, because the selected data asset supplies this value — Splunk index name. Leave blank to use the default index configured on the token. Required: No. |
| Sourcetype | sourcetype | Legacy panel; read-only when dataAssetId is set, because the selected data asset supplies this value — Value assigned to the record's sourcetype field (e.g. _json). Required: No. |
| Source | source | Legacy panel — Value assigned to the record's source field (e.g. fleak). Required: No. |
| Batch Size | batchSize | Legacy panel — Number of records sent in a single HEC request. Default: 500. Required: No. |
| Verify SSL Certificates | verifySsl | Legacy panel; read-only when dataAssetId is set, because the selected data asset supplies this value — Validate the Splunk endpoint's TLS certificate. Turn off only for self-signed development clusters. Default: true. Required: No. |
Overview
The Splunk HEC Sink node forwards records from your workflow to Splunk through the HTTP Event Collector. Records are buffered and sent in batches, and you can tag every record with a specific index, sourcetype, and source. Authentication uses an API Key connection profile holding the HEC token, created inline while creating the Splunk HEC Endpoint data asset.
The endpoint is defined by a
Splunk HEC Endpoint data asset, which supplies the
HEC URL (the full event endpoint, e.g. https://splunk.example.com:8088/services/collector/event) and index, and links the
API Key connection profile holding the HEC token. That profile is created in the asset's Connect to Splunk step with + Add new connection profile, not on the settings page. A Splunk connection profile (Splunk URL, username, and password) is a different type and cannot be used here. In Destination, the node sets Source, Sourcetype, Batch Size, and Verify SSL Certificates. In an asset-managed legacy panel, Sourcetype and SSL verification come from the asset and are read-only.
Setting behavior
Destination does not expose inline HEC URL or credential inputs. The asset stores HEC URL. In Data Assets → Asset Information → Edit, existing Index and Verify SSL Certificates properties can be updated with Save → Save Changes. The HEC URL input is visible, but Save rejects a changed HEC URL. Create a replacement asset for a different endpoint, select it in Asset Name, and Save. To change the token, click the profile name in the asset's Connection Profile card in Data Assets; the API Key profile opens in Settings → Connection Profiles, where its owner can use Edit in Configuration, then Save → Save Changes. API Key profiles are not listed on that page, so open them from the asset. Re-deploy affected workflows for changes to apply to running deployments. An asset-managed legacy panel displays the HEC URL and credential read-only.
Write Failures
Each HEC request carries up to Batch Size records and succeeds only on HTTP 200.
- Rate limiting, server errors and network failures are retried. On HTTP
429, any5xxstatus or a network error, the request gets up to 3 attempts, waiting 1 second and then 2 seconds between them. A retry re-sends the whole request. - Other errors are not retried. Any other status, such as
400,401or403, fails the request at once. - Records in a failed request are dropped. They are counted as errors and not sent again. A request that timed out may still have been indexed by Splunk, so some of these records can be in Splunk.
Because failed records are dropped, HEC delivery is neither exactly-once nor at-least-once. See Delivery Guarantees and Write Failures.
Related Nodes
- S3 Sink: Write batched records to Amazon S3
- Data Assets: Defining the HEC endpoint
- Connection Profiles: Storing the HEC token