Which HTTP Event Collector (HEC) endpoint should be used to collect data in the following format? {“message”:“Hello World”, “foo”:“bar”…

The services/collector path is the base endpoint for the Splunk HTTP Event Collector (HEC) used for data ingestion. The provided data is a structured JSON object, which is specifically handled by the /services/collector/event endpoint. Since /services/collector/event is not an available option, the base path services/collector is the most appropriate choice. This correctly identifies the data collection service, distinguishing it from REST API endpoints used for configuration or endpoints for different data types.

A. data/inputs/http/{name} is a REST API endpoint for configuring a specific HEC token, not for sending event data.

B. services/collector/raw is the HEC endpoint for sending unstructured, raw text data, not structured JSON objects.

D. data/inputs/http is the base REST API endpoint for managing HEC configurations, not for ingesting data.

1. Splunk Enterprise Documentation

Getting Data In Manual

"Set up and use HTTP Event Collector in Splunk Web": This document specifies the different HEC endpoints. It states

"The two types of HEC endpoints are the /services/collector/event endpoint

for JSON-formatted events

and the /services/collector/raw endpoint

for raw text." This confirms that the provided JSON data is intended for an endpoint under the /services/collector path and that the /raw endpoint is incorrect.

2. Splunk Enterprise Documentation

REST API Reference Manual

"data/inputs/http": This reference describes the endpoints for managing HEC tokens. It states

"Use this endpoint to create

view

and edit HTTP Event Collector tokens." This confirms that the data/inputs/http path (options A and D) is for configuration

not data ingestion.

3. Splunk Enterprise Documentation

Getting Data In Manual

"Format events for HTTP Event Collector": This section details the required JSON wrapper for the /event endpoint. It clarifies that structured JSON like the example is the intended format for the event collector

distinguishing it from the /raw endpoint. The base path for this functionality is services/collector.