Ingest raw Splunk HEC events

POST/services/collector/raw

Ingest a raw payload. Each line of a text/plain body becomes an event; JSON bodies are also accepted. Event metadata is supplied through query parameters rather than an envelope.

Warning

Use this endpoint to ingest raw payloads through the Splunk HTTP Event Collector (HEC) compatible API. For a walkthrough, see Send data using the Splunk HEC API.

The base domain for this endpoint is hec. prefixed to the base domain of your edge deployment. For example, if your edge deployment’s base domain is us-east-1.aws.edge.axiom.co, the HEC endpoint is https://hec.us-east-1.aws.edge.axiom.co.

Edge deployment	Base domain for ingest and query
`US East 1 (AWS)`	`us-east-1.aws.edge.axiom.co`
`EU Central 1 (AWS)`	`eu-central-1.aws.edge.axiom.co`

This endpoint only supports API tokens. Personal access tokens (PATs) aren't supported. For more information, see Tokens.

Parameters

Property	Type	Location	Description
`index`	`string`	`query`	The dataset (Splunk index) to ingest into.
`sourcetype`	`string`	`query`	The sourcetype to attach to every event in the request.
`source`	`string`	`query`	The source to attach to every event in the request.
`host`	`string`	`query`	The host to attach to every event in the request.

Body

Raw event data. Each line becomes a separate event.

text/plainapplication/json

Request

curl -X POST 'https://hec.{axiom-domain}/services/collector/raw' \
  -H 'Authorization: Bearer API_TOKEN' \
  -H 'Content-Type: text/plain' \
  -d '{"message":"hello from Axiom","status":200}'

Try itRun this request against your Axiom organization

Credentials stay in this browser tab and are only sent to Axiom when you run the request.

API token Requiredindex querysourcetype querysource queryhost queryRequest body text/plain

Response

200The events were accepted.

application/json

400The request could not be processed. The `code` field identifies the Splunk error: `5` (no data), `6` (invalid data format), or `7` (incorrect index).

application/json

Property	Type	Description
`text`	`string`Required	A human-readable status message.
`code`	`integer`Required	The Splunk status code. `0` indicates success, `17` indicates a healthy collector, and `5`, `6`, and `7` indicate no data, invalid data format, and incorrect index respectively.