Splunk HEC Source

Realm exposes a Splunk HTTP Event Collector (HEC) compatible endpoint that Splunk forwarders and HEC-capable pipeline tools can send events to directly. This allows you to route logs from various products that can send logs over Splunk HEC into Realm without additional middleware.

Create a Source in Realm

1. In Realm, go to Sources > Add Source.
2. Enter a name for your source.
3. Set Product Format to match the format of the logs being forwarded (e.g., a specific vendor format or Custom JSON if your vendor is not listed).
4. Click Save.

Add a Splunk HEC Input Feed

1. On the Select Transport Method step in the Add Source flow, or from the source page, click Add Input Feed.
2. Select Splunk HEC and give it a name.
3. Enter a token if you have one or leave it empty to have the system generate a random token for you.
4. Click Save.
5. Click ... > Edit on the newly created input feed.
6. Click on eye icon in the token field to view token value.
7. Copy the HEC Endpoint URL and Token — you will need these when configuring your source vendor product.

Troubleshooting

Authentication errors

• Ensure there are no leading or trailing spaces in the token value.

TLS / certificate errors

• Realm HEC endpoints use a publicly trusted TLS certificate. If the forwarder/source vendor reports certificate verification failures, ensure the host has up-to-date CA certificates installed.