Splunk Send
CertifiedEnterprise EditionSend events to Splunk HTTP Event Collector
Splunk Send
Send events to Splunk HTTP Event Collector
POSTs event data to a Splunk HEC endpoint using the Splunk token authentication scheme. Accepts raw event data as a string or a Kestra internal storage file URI.
type: io.kestra.plugin.ee.splunk.events.SendExamples
Send an event to Splunk HEC
id: splunk_hec_send
namespace: company.team
tasks:
- id: send
type: io.kestra.plugin.ee.splunk.events.Send
host: http-inputs.splunkcloud.com
port: "443"
token: "{{ secret('SPLUNK_HEC_TOKEN') }}"
eventData: '{"level": "INFO", "message": "Workflow completed"}'
sourcetype: myapp:events
index: main
Forward a storage file to Splunk HEC
id: splunk_hec_file
namespace: company.team
tasks:
- id: send
type: io.kestra.plugin.ee.splunk.events.Send
host: http-inputs.splunkcloud.com
token: "{{ secret('SPLUNK_HEC_TOKEN') }}"
inputFile: "{{ outputs.previous_task.uri }}"
sourcetype: myapp:batch
Properties
host *string
Splunk host
Hostname of the Splunk endpoint (e.g. michmed.splunkcloud.com)
token *string
HEC token
Token for HEC authentication; sent as Authorization: Splunk <token>
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150eventData string
Event data
Raw event payload — a string or JSON; mutually exclusive with inputFile
hostField string
Host field
Value for the Splunk host metadata field; omitted from the payload when not set
index string
Splunk index
Target Splunk index; omitted from the payload when not set
inputFile string
Input file URI
Kestra internal storage URI of a file whose content is sent as the event; mutually exclusive with eventData; the entire file is loaded into memory
options
HTTP client options
Optional HTTP client configuration — timeouts, TLS, proxy, etc.
io.kestra.core.http.client.configurations.HttpConfiguration
falseIf true, allow a failed response code (response code >= 400)
List of response code allowed for this request
The authentication to use.
io.kestra.core.http.client.configurations.BasicAuthConfiguration
The password for HTTP basic authentication.
The username for HTTP basic authentication.
io.kestra.core.http.client.configurations.BearerAuthConfiguration
The token for bearer token authentication.
io.kestra.core.http.client.configurations.DigestAuthConfiguration
The password for HTTP Digest authentication.
The username for HTTP Digest authentication.
UTF-8The default charset for the request.
java.nio.charset.Charset
trueWhether to enable TCP Keep-Alive extended socket options (TCP_KEEPIDLE, TCP_KEEPINTERVAL, TCP_KEEPCOUNT).
Set to false when running on Windows workers, as these extended socket options are not supported by the Windows JDK and will cause connection failures.
trueWhether redirects should be followed automatically.
REQUEST_HEADERSREQUEST_BODYRESPONSE_HEADERSRESPONSE_BODYThe enabled log.
The proxy configuration.
io.kestra.core.http.client.configurations.ProxyConfiguration
The address of the proxy server.
The password for proxy authentication.
The port of the proxy server.
DIRECTDIRECTHTTPSOCKSThe type of proxy to use.
The username for proxy authentication.
The SSL request options
io.kestra.core.http.client.configurations.SslOptions
Whether to disable checking of the remote SSL certificate.
Only applies if no trust store is configured. Note: This makes the SSL connection insecure and should only be used for testing. If you are using a self-signed certificate, set up a trust store instead.
The timeout configuration.
io.kestra.core.http.client.configurations.TimeoutConfiguration
The time allowed to establish a connection to the server before failing.
PT5MThe time allowed for a read connection to remain idle before closing it.
port string
443HEC port
Port of the HEC endpoint; defaults to 443
scheme string
httpsURL scheme
URL scheme — http or https; defaults to https
source string
Source
Splunk source field; omitted from the payload when not set
sourcetype string
Source type
Splunk sourcetype; omitted from the payload when not set
Outputs
statusCode integer
HTTP status code
Status code returned by the Splunk HEC endpoint
statusMessage string
HTTP status message
Reason phrase returned by the Splunk HEC endpoint
Metrics
events.sent counter
Number of events sent to Splunk HEC
