Another very versatile and highly scalable way of getting data into Splunk is via the HTTP Event Collector (HEC), which is a solution that listens for HTTP requests containing JSON objects. The HTTP Event Collector can collect data at extremely high volumes from many devices and data sources, all on a single port. Another interesting feature of using HEC is that the host, index, source, and sourcetype associated with a given data source can be specified within the JSON object of each received event.
The HTTP Event Collector uses a token-based authentication model; you configure a new token in Splunk, and give that token to your application developers who then include it in each event sent to Splunk.
To set up the HTTP Event Collector, you first configure the global settings, which includes the HTTP endpoint it will listen on – by default...
