Send data from Splunk to Axiom

Integrate Axiom in your existing Splunk app with minimal effort and without breaking any of your existing Splunk stack.

This page explains how to send data from Splunk forwarders and Splunk logging libraries to Axiom.

Axiom provides a Splunk HEC compatible API on your edge deployment. Any tool that sends data to a Splunk HTTP Event Collector (HEC) can send the same data to Axiom without changes to its code.

Prerequisites

Create an Axiom account.
Create a dataset in Axiom where you send your data.
Create an API token in Axiom with permissions to ingest data to the dataset you have created.

Configure Splunk clients

In your Splunk forwarder or HEC client, specify the following:

The HEC URL is https://hec.AXIOM_DOMAIN/services/collector/event?index=DATASET_NAME. For raw text payloads, use https://hec.AXIOM_DOMAIN/services/collector/raw?index=DATASET_NAME.
The HEC token is your Axiom API token. The API accepts Authorization: Splunk API_TOKEN, Authorization: Bearer API_TOKEN, and HTTP basic authentication.
Optional: If your client sets the index field on events instead of in the URL, Axiom sends each event to the dataset with that name.

For the full description of the API, including envelope fields and response codes, see Send data to Axiom using the Splunk HEC API.

Examples

Send logs from JavaScript using `splunk-logging`

javascript

var SplunkLogger = require('splunk-logging').Logger;

var config = {
  token: 'API_TOKEN',
  url: 'https://hec.AXIOM_DOMAIN:443/services/collector/event?index=DATASET_NAME',
};

var Logger = new SplunkLogger(config);

var payload = {
  // Message can be anything; doesn’t have to be an object
  message: {
    temperature: '70F',
    chickenCount: 500,
  },
};

console.log('Sending payload', payload);
Logger.send(payload, function (err, resp, body) {
  // If successful, body will be { text: 'Success', code: 0 }
  console.log('Response from Axiom', body);
});

Send logs from Python using `splunk_handler`

python

import logging
from splunk_handler import SplunkHandler
splunk = SplunkHandler(
        host='hec.AXIOM_DOMAIN',
        port='443',
        protocol='https',
        token='API_TOKEN',
        index='DATASET_NAME'
    )

logging.getLogger('').addHandler(splunk)

logging.warning('Hello from Axiom!')

Send logs from Go using `net/http`

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"time"
)

func main() {
	event := map[string]any{
		"time":       time.Now().Unix(),
		"sourcetype": "httpevent",
		"event": map[string]any{
			"message": "hello from Axiom",
			"level":   "info",
		},
	}
	body, _ := json.Marshal(event)

	req, _ := http.NewRequest(http.MethodPost, "https://hec.AXIOM_DOMAIN/services/collector/event?index=DATASET_NAME", bytes.NewReader(body))
	req.Header.Set("Authorization", "Splunk API_TOKEN")
	req.Header.Set("Content-Type", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	fmt.Println(resp.Status)
}