Snippets · Destinations

Send to Splunk over HEC

Splunk ingests through the HTTP Event Collector. The splunk_hec exporter sends logs and metrics with the index, source and sourcetype you choose, authenticated with a HEC token from the environment.

OpenTelemetry Collector

OpenTelemetry Collector YAML

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  batch:
    timeout: 5s

exporters:
  splunk_hec:
    endpoint: https://splunk.example.internal:8088/services/collector
    token: ${env:SPLUNK_HEC_TOKEN}
    index: otel
    sourcetype: otel
    source: otelcol
    disable_compression: false
    sending_queue:
      enabled: true
      queue_size: 5000
    retry_on_failure:
      enabled: true
      initial_interval: 5s
      max_interval: 30s
      max_elapsed_time: 300s

service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: [memory_limiter, batch]
      exporters: [splunk_hec]
    metrics:
      receivers: [otlp]
      processors: [memory_limiter, batch]
      exporters: [splunk_hec]

LinkMesh

Library › Destinations › Splunk HEC

HEC Endpoint: https://splunk.example.internal:8088/services/collector
HEC Token: ${env:SPLUNK_HEC_TOKEN}
Index: otel
Source: otelcol
Source Type: otel
Durable Delivery: true

What LinkMesh then pushes to the collector, under exporters:

Pushed to the collector

splunk_hec/output_dst_00000502:
  endpoint: https://splunk.example.internal:8088/services/collector
  index: otel
  sending_queue:
    block_on_overflow: false
    enabled: true
    storage: file_storage/output_dst_00000502
  source: otelcol
  sourcetype: otel
  token: ${env:SPLUNK_HEC_TOKEN}

# extensions:
file_storage/output_dst_00000502:
  create_directory: true
  directory: /var/lib/otelcol-supervisor/sending-queue/output_dst_00000502

The same, as an API call (see automation recipes):

API call

curl -X POST "$LINKMESH/destinations" \
  -H "Authorization: Bearer $LMSAT" \
  -H "Content-Type: application/json" \
  -d '{
  "defaultConfig": {
    "durable_queue": true,
    "endpoint": "https://splunk.example.internal:8088/services/collector",
    "index": "otel",
    "source": "otelcol",
    "sourcetype": "otel",
    "token": "${env:SPLUNK_HEC_TOKEN}"
  },
  "exporterType": "splunk_hec",
  "name": "Splunk HEC",
  "signalTypes": [
    "logs",
    "metrics"
  ]
}'

The rest of the collector config above (otlp, memory_limiter, batch) is not part of this template: in LinkMesh those are separate sources, processors and destinations on the route.

Generated from LinkMesh's template catalogue by linkmesh-server snippet-render 1.464.3, not written by hand.

Download config.yamlValidated with otelcol-contrib v0.161.0 on 2026-10-26

Complete config files, each checked with the collector's own validate command (otelcol-contrib v0.161.0).

The gotcha

An empty token stops the whole collector, not just this exporter. In our test, with SPLUNK_HEC_TOKEN unset, otelcol-contrib refused the config with "exporters::splunk_hec: requires a non-empty \"token\"". Make the variable part of the service unit or deployment.

Used in these pipelines

Firewall syslog to a SIEM, with PII masked

Manage this across a fleet

LinkMesh manages collector configuration across a fleet from one self-hosted control plane, so a change like this is made once rather than host by host. The first 25 Collectors are free after a no-card registration in the OpenSight Customer Portal (5 without one).

Doing this in LinkMesh: Destinations

Install LinkMesh →See all snippets