Splunk connector

Class: splunk — integrates with Splunk. Sources pull or receive via Splunk-oriented endpoints and publish to a stream; sinks subscribe to a stream and deliver toward Splunk, commonly HTTP Event Collector (HEC).

Create and edit under Sources and Sinks. Advanced Settings may expose more runtime options depending on deployment and permissions.

Source and sink behavior

Role	Behavior
Source	HEC listen on endpoint with Splunk token (Authorization: Splunk). Bounded ingest queue (1024 POST batches). Success 200 {text, code: 0} after enqueue. Channel full → 503 {text: "Server is busy", code: 9} (no Retry-After). Generic webhooks use http_server.
Sink	Stream subscription → HEC POST to endpoint authenticated with the HEC token; respect Splunk size and rate limits via batching when configured.
Streams	Same stream wiring model as other classes (Streams).

Required fields

Every connector row

Field	Required	Notes
name	Yes	Display name; id derived from it.
class	Yes	Must be splunk.
stream	Yes	Resolved stream id.
type	Yes	source or sink from the screen used at create time.
config	Yes	Class-specific object; see below.

Class splunk — required configuration

Setting	Required	Notes
endpoint	Yes	Splunk HEC URL.
token	Yes	HEC token (UI: HEC Token).

Create connector

1. Open Sources or Sinks → Create.
2. Set Class to Splunk, set name, stream behavior, and Enabled.
3. Enter Endpoint and HEC Token.
4. Add TLS, headers, or batch limits from Common configuration when available.
5. Save, then wire the stream into tasks / pipelines.

Source (UI)

The Splunk source connector form.

UI field	Connector setting
Endpoint (required)	endpoint
HEC Token (required)	token (exact nested key may vary by build—confirm via Registry export if needed)

Sink (UI)

Same Endpoint + HEC Token layout on Create New Sink (titles differ).

The Splunk sink connector form.

Configuration

Beyond the required pair, exports often include:

• tls — Verify Splunk server certificates in production.
• authentication — Extra headers or schemes when HEC is wrapped.
• batch — Keep posts under Splunk size and rate limits (common on sinks).

Runtime behavior

• Connectors run after deployment; Disabled connectors do not listen or call HEC.
• Source (HEC): 200 after enqueue, not after WAL/stream publish. Busy channel is 503 + HEC code 9 (UF/HF retry 5xx). Same bounded helper as HTTP server; HTTP server maps full to 429 instead.
• Sinks should respect Splunk indexer health and 429 / throttle behavior via retries and batch caps where implemented.

Performance and operational notes

• Tune batch to HEC max_content_length and licensing throughput.
• Rotate HEC tokens on compromise; treat tokens as secrets.

Related pages

• HTTP server connector — generic HTTPS POST listen (429 when full)
• HTTP connector — outbound REST client
• Sources · Sinks
• splunk-sink-connector-example.json — external JSON shape comparison (not identical to PADAS registry schema)
• Motion Engine configuration — runtime / registry operational context