---
url: https://docs.realmsec.info/integration/splunk-hec.md
---

# Splunk HEC Source

Realm exposes a Splunk HTTP Event Collector (HEC) compatible endpoint that Splunk forwarders and HEC-capable pipeline tools can send events to directly. This allows you to route logs from various products that can send logs over Splunk HEC into Realm without additional middleware.

## Create a Source in Realm

1. In Realm, go to **Sources > Add Source**.
2. Enter a name for your source.
3. Set **Product Format** to match the format of the logs being forwarded (e.g., a specific vendor format or **Custom JSON** if your vendor is not listed).
4. Click **Save**.

## Add a Splunk HEC Input Feed

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **Splunk HEC** and give it a name.
3. Enter a token if you have one or leave it empty to have the system generate a random token for you.
4. Click **Save**.
5. Click **`...` > Edit** on the newly created input feed.
6. Click on eye icon in the token field to view token value.
7. Copy the **HEC Endpoint URL** and **Token** — you will need these when configuring your source vendor product.

## Troubleshooting

**Authentication errors**

* Ensure there are no leading or trailing spaces in the token value.

**TLS / certificate errors**

* Realm HEC endpoints use a publicly trusted TLS certificate. If the forwarder/source vendor reports certificate verification failures, ensure the host has up-to-date CA certificates installed.