Skip to main content

Review the Splunk HEC Reference

This path inspects repository artifacts. It does not tail host logs, send a HEC request, or validate a Splunk index.

Prerequisites​

  • A checkout of this repository
  • A shell with sed and rg
  • No Splunk endpoint or token

Run the inspection​

From the repository root:

test -f static/pipelines/splunk-production-pipeline.yaml
test -f examples/integrations/splunk-input.yaml
sed -n '1,80p' examples/integrations/splunk-input.yaml
rg -n 'file:|mapping:|http|SPLUNK_HEC_TOKEN' \
  static/pipelines/splunk-production-pipeline.yaml

Expected output​

Both file checks exit successfully. The fixture shows synthetic logs, and the final command identifies file input, mapping, HTTP output, and token placeholder.

Cleanup​

No files or external resources are created.

Common failures​

  • A missing file means the checkout does not contain the referenced artifact.
  • No search matches means the reference changed; inspect the complete file before updating this route.
  • Syntax inspection does not validate HEC authentication, acknowledgement, indexing, or retention behavior.

Next: Inspect file collection.