Skip to main content
Version: Nightly

Splunk

GreptimeDB implements a subset of the Splunk HTTP Event Collector (HEC) protocol, so a shipper that already speaks HEC — Vector, the OpenTelemetry Collector — writes to GreptimeDB by changing the endpoint URL and the token.

The base path is /v1/splunk; the client appends the collector path.

EndpointPurpose
/services/collector/eventStructured JSON events
/services/collector/rawPlain text, stored verbatim

Mapping: a Splunk index becomes a GreptimeDB table. host, source, sourcetype, and the keys under fields become tag columns and join the table's primary key.

Not implemented:

  • Indexer acknowledgment (/services/collector/ack).
  • The channel parameter is accepted and ignored.
  • Fluent Bit's native splunk output, which hardcodes the request path and cannot reach /v1/splunk. Use its HTTP output instead.

Endpoint details, response codes, and shipper configuration are in Ingest Data with Splunk.