Axiom
Overview

Ingest Splunk HEC events

Use this endpoint to ingest events through the Splunk HTTP Event Collector (HEC) compatible API. For a walkthrough, see Send data using the Splunk HEC API.

The base domain for this endpoint is hec. prefixed to the base domain of your edge deployment. For example, if your edge deployment’s base domain is us-east-1.aws.edge.axiom.co, the HEC endpoint is https://hec.us-east-1.aws.edge.axiom.co.

Edge deployment Base domain for ingest and query
US East 1 (AWS) us-east-1.aws.edge.axiom.co
EU Central 1 (AWS) eu-central-1.aws.edge.axiom.co

This endpoint only supports API tokens. Personal access tokens (PATs) aren't supported. For more information, see Tokens.

POST/services/collector/event
Features

Send the token in the Authorization: Bearer API_TOKEN header. See Tokens for which token types this endpoint accepts.

Input8
Authorizationheaderrequired
Sent from your browser straight to the API — never to Docsbook, never stored.
indexstring · body
(query) The dataset (Splunk index) to ingest into. Overrides the index field in the event envelope.
eventobject · body
The event payload. When an object, its keys become top-level fields of the Axiom event. When a string, it is stored in the _raw field.
fieldsobject · body
Additional fields merged into the event.
timeobject · body
The event timestamp, as epoch seconds, epoch milliseconds, or an RFC 3339 string. When omitted, Axiom assigns the ingest time.
indexstring · body
The dataset (Splunk index) to ingest into. The index query parameter takes precedence.
hoststring · body
sourcestring · body
sourcetypestring · body
Output2
textstring
A human-readable status message.
codeinteger
The Splunk status code. 0 indicates success, 17 indicates a healthy collector, and 5, 6, and 7 indicate no data, invalid data format, and incorrect index respectively.
Responses
200The events were accepted.
400The request could not be processed. The code field identifies the Splunk error: 5 (no data), 6 (invalid data format), or 7 (incorrect index).
Example input
curl -X POST 'https://hec.AXIOM_DOMAIN/services/collector/event' \
  -H 'Authorization: Bearer API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "event": {
      "message": "hello from HEC",
      "severity": "INFO"
    },
    "sourcetype": "httpevent"
  }'
Example output
{
  "text": "Success",
  "code": 0
}

Updated

Was this page helpful?