Copy page

Universal

Monad Splunk HEC Input

Accepts POSTed data directly to your pipeline's Splunk HEC endpoints.

Details

The Splunk HEC input implements the Splunk HEC endpoints. By creating a Splunk HEC Input, users can publish any data they wish to a pipeline without needing to have a specifically implemented input to support that data.

Prerequisites

There are no Prerequisites to start using the Splunk HEC input. Simply create a Splunk HEC Input and attach it to a pipeline.

Sending data

Every pipeline has its own ingest host, and the collector endpoints are served on it:

Code
https://<pipeline-id>.data.monad.com/services/collector

Replace <pipeline-id> with the ID of your pipeline. Point any HEC client at that host, using whichever collector path it already speaks. The paths are unchanged from the Splunk HEC standard and are listed below.

The body of the request requires that records be put in the event key in an array of json objects for each record.

Note: When including multiple records, the format is line delimited JSON object

Authentication

Every request to the Splunk HEC endpoints must carry a HEC token. The token is your pipeline ID, and it is what identifies the pipeline, so it is required even when you post to the pipeline's own ingest host.

On the wire, the token is sent in a standard Splunk authorization header:

Code
Authorization: Splunk <pipeline-id>

The token is just <pipeline-id>. The header value is Splunk <pipeline-id>. Which one you enter depends on your sender:

Your sender asks for	Enter	Example
A HEC token (often labeled HEC Token, Token, or Secret Token)	The pipeline ID only, without Splunk	Fivetran External Logging (Splunk log service)
A raw Authorization header value	Splunk <pipeline-id>	curl, generic HTTP clients, custom header settings
A username and password (HTTP Basic auth)	The pipeline ID as the password; the username is ignored	Tailscale log streaming

When your sender asks for connection details separately, use the pipeline's ingest host <pipeline-id>.data.monad.com, port 443, with SSL/TLS enabled.

Single record

POST /services/collector or POST /services/collector/event

The json object in event will be sent to the pipeline directly. All other fields supported by the Splunk HEC standard will be ignored.

Code
{
  "event": {}
}

POST /services/collector/raw

Monad requires that all records are in JSON format which requires the raw endpoint to require each event to be a json object

Code
{}

Multiple Records

POST /services/collector or POST /services/collector/event

Code
{
  "event": {}
}
{
  "event": {}
}
{
  "event": {}
}

POST /services/collector/raw

Code
{}
{}
{}

Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

Settings

None.

Secrets

None.

API

To send a POST request to create this Monad HTTP Connector:

Code
curl -X 'POST' \
  '{base_url}/api/v2/{org_id}/inputs' \
  -H 'accept: application/json' \
  -H 'x-api-key: {api_key}' \
  -H 'Content-Type: application/json' \
  -d '{
  "config": {
    "secrets": {},
    "settings": {}
  },
  "description": "input_description",
  "name": "input_name",
  "type": "monad-splunk-hec"
}'

Python Example

Code
import requests
import json

url = 'https://<pipeline-id>.data.monad.com/services/collector'
headers = {
    'accept': 'application/json',
    'Content-Type': 'application/json',
    'Authorization': 'Splunk <pipeline-id>',
}
data = {
    'event': 
        {
            'dummy-key': 'dummy-data'
        }
}

response = requests.post(url, headers=headers, json=data)
print(json.dumps(response.json(), indent=2))

Troubleshooting

Authentication failures return HTTP 400 with the reason in the error field of the response body.

Error	Likely cause	Fix
pipeline not found right after setup	The Splunk prefix was entered in a HEC token field, so it was sent twice	Enter only the pipeline ID in the token field
pipeline not found	The token isn't the ID of an existing pipeline	Copy the pipeline ID again from the pipeline in Monad
authorization header is required	No token was sent	Set the token in your sender; see Authentication
authorization header must start with 'Splunk' or use basic auth	A raw header value was entered without the Splunk prefix	Enter Splunk <pipeline-id> as the header value
invalid token	The pipeline exists but its input isn't a Splunk HEC input	Use the ID of a pipeline whose input is the Splunk HEC input

Sync frequency

This is a push (receiver) input: Monad ingests records as the source sends them, so there is no polling interval. See Input Sync Frequency for details.