HEC Endpoint and Test HEC

Applicability

Splunk Cloud, Splunk Enterprise

Description

When setting up an HEC data input (Settings > Data Inputs > HTTP Event Collector), it was configured to send JSON data via HTTPS. What should be the HEC endpoint (target URL) to be used?



 

Investigation

Review the following documentation articles pertaining Splunk HTTP Event Collector:

Set up and use HTTP Event Collector in Splunk Web - Splunk Documentation
HTTP Event Collector examples - Splunk Documentation
HTTP Event Collector REST API endpoints - Splunk Documentation

The articles contents will allow to determine the correct HEC URI, HEC endpoint and port required to test HEC ingestion.

Resolution

Solution
The Http Event Collector (HEC) endpoint is typically something like this:

Only for trial versions

https://http-inputs-<stack>.splunkcloud.com:8088

By default for Splunk Cloud stacks

https://http-inputs-<stack>.splunkcloud.com:443

Relevant considerations for Send data to HTTP Event Collector:

Relevant considerations for Send data to HTTP Event Collector on Splunk Enterprise

Test
Test something like this (with sample response output).

splunk $ curl -k https://http-inputs-<stack>.splunkcloud.com/services/collector/event -H "Authorization: Splunk <TOKEN>" -d '{"event": "hello world"}'
{"text":"Success","code":0}

Kinesis Firehose
The one exception to be aware of, is "Kinesis Firehose," which requires a special ELB setup (open a Splunk Cloud Support ticket), and has the below endpoint. Kinesis Firehose is also the only HEC that has "Indexer Acknowledgement" turned ON.

https://http-inputs-firehose-<stack>.splunkcloud.com

Test Firehose
The "ELB key" is provided by the Ops team when the firehose ELB is created.

curl -k https://http-inputs-firehose-<stack>.splunkcloud.com/services/collector/event -H "X-Splunk-Request-Channel: XXXELBKEYXXX" -H 
'Authorization: Splunk XXXHECTOKENXXX' -d '{"event":"Splunk HEC Test"}' -v

 

Related Links

Set up and use HTTP Event Collector in Splunk Web - Splunk Documentation
HTTP Event Collector examples - Splunk Documentation
HTTP Event Collector REST API endpoints - Splunk Documentation

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release