Skip to content

docs: document the Splunk HEC edge ingest API - #699

Open
ronoc wants to merge 2 commits into
mainfrom
docs/hec
Open

docs: document the Splunk HEC edge ingest API#699
ronoc wants to merge 2 commits into
mainfrom
docs/hec

Conversation

@ronoc

@ronoc ronoc commented Aug 6, 2026

Copy link
Copy Markdown
Member

Add a Send data guide for the Splunk HTTP Event Collector (HEC) compatible API served from the edge (hec.AXIOM_DOMAIN): the event, raw and health endpoints, the Splunk/Bearer/Basic auth schemes, index → dataset resolution, event-envelope field mapping, gzip payloads, and the Splunk response-code table. Link it from the send-data methods hub.

Distinct from the existing /endpoints/splunk page, which documents the generated *.ingress.axiom.co Splunk-compatible endpoint rather than the native edge HEC service.

Add a Send data guide for the Splunk HTTP Event Collector (HEC)
compatible API served from the edge (hec.AXIOM_DOMAIN): the event, raw
and health endpoints, the Splunk/Bearer/Basic auth schemes, index →
dataset resolution, event-envelope field mapping, gzip payloads, and
the Splunk response-code table. Link it from the send-data methods hub.

Distinct from the existing /endpoints/splunk page, which documents the
generated *.ingress.axiom.co Splunk-compatible endpoint rather than the
native edge HEC service.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercel Bot commented Aug 6, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs Ready Ready Preview Aug 6, 2026 3:45pm

Request Review

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

📝 Vale prose report

🔵 4 suggestions

Location Rule Message
🔵 content/docs/(documentation)/send-data/splunk-hec.mdx:68 Google.Contractions Use 'it's' instead of 'it is'.
🔵 content/docs/(documentation)/send-data/splunk-hec.mdx:119 Google.Contractions Use 'couldn't' instead of 'could not'.
🔵 content/docs/(documentation)/send-data/splunk-hec.mdx:120 Google.Contractions Use 'couldn't' instead of 'could not'.
🔵 content/docs/(documentation)/send-data/splunk-hec.mdx:122 Google.Contractions Use 'isn't' instead of 'is not'.

Advisory only — this check never blocks the PR.

ℹ️ How to read this & when it's fine to ignore

This is advisory prose linting (Vale with the Google developer style guide). It is guidance, not a gate — nothing here blocks the merge.

Fix the suggestions that improve the writing (contractions, first-person "we", terminology). It's expected that some won't make sense — ignore those. Vale reads Markdown as prose, so it sometimes flags code, identifiers, product/UI names, or example data that only look like prose. Those are false positives; leaving them is the right call.

To silence a false positive at the source:

  • Wrap code-like text (identifiers, values, query fragments, durations) in `backticks` so Vale treats it as code.
  • Wrap a whole region — e.g. an example or data table — between {/* vale off */} and {/* vale on */}.

If a rule is consistently wrong for our docs, propose disabling it in .vale.ini rather than working around it each time.

Add a v1-edge-hec OpenAPI document covering the HEC event, raw, bare
collector alias, and health endpoints (served from hec.AXIOM_DOMAIN),
with HecEvent/HecStatus schemas and the Splunk/Bearer/Basic auth
scheme. Register it in lib/openapi.ts, add operation pages for the
event, raw, and health endpoints under the Edge endpoints nav group,
and cover the new spec in the OpenAPI test.

A separate document rather than an addition to v1-edge-ingest because
HEC lives on its own host (hec.AXIOM_DOMAIN) with the /services/collector
base path, distinct from the edge ingest server.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants