Ingest raw Splunk HEC events
Use this endpoint to ingest raw payloads through the Splunk HTTP Event Collector (HEC) compatible API. For a walkthrough, see Send data using the Splunk HEC API.
The base domain for this endpoint is hec. prefixed to the base domain of your edge deployment. For example, if your edge deployment’s base domain is us-east-1.aws.edge.axiom.co, the HEC endpoint is https://hec.us-east-1.aws.edge.axiom.co.
| Edge deployment | Base domain for ingest and query |
|---|---|
US East 1 (AWS) |
us-east-1.aws.edge.axiom.co |
EU Central 1 (AWS) |
eu-central-1.aws.edge.axiom.co |
This endpoint only supports API tokens. Personal access tokens (PATs) aren't supported. For more information, see Tokens.
POST
/services/collector/rawFeatures
Send the token in the Authorization: Bearer API_TOKEN header. See Tokens for which token types this endpoint accepts.
Request body: text/plain. Raw event data. Each line becomes a separate event.
Input4
Sent from your browser straight to the API — never to Docsbook, never stored.
(query) The dataset (Splunk index) to ingest into.
(query) The sourcetype to attach to every event in the request.
(query) The source to attach to every event in the request.
(query) The host to attach to every event in the request.
Output2
A human-readable status message.
The Splunk status code.
0 indicates success, 17 indicates a healthy collector, and 5, 6, and 7 indicate no data, invalid data format, and incorrect index respectively.Responses
200The events were accepted.
400The request could not be processed. The
code field identifies the Splunk error: 5 (no data), 6 (invalid data format), or 7 (incorrect index).Example input
curl -X POST 'https://hec.AXIOM_DOMAIN/services/collector/raw' \
-H 'Authorization: Bearer API_TOKEN' \
-H 'Content-Type: application/json' \
-d '{}'Example output
{
"text": "Success",
"code": 0
}