Summary

In this chapter, you learned about the HEC and how it can be used to send data directly from an application to Splunk. To do this, you learned how to enable the HEC and create a token used as authorization to process the request. You also saw how to use cURL to submit event data. Lastly, you learned how to enrich the HEC functionality using index acknowledgement.

In the next chapter, we'll move on and learn more ways to work with Splunk as effectively as possible.