[sinks.my_splunk_hec_logs_sink] +type = "splunk_hec_logs" -type = "splunk_hec" |
CommonAdvanced TOMLYAMLJSON [sinks.my_sink_id] type = "splunk_hec_logs" inputs = [ "my-source-or-transform-id" ] endpoint = "https://http-inputs-hec.splunkcloud.com" host_key = "hostname" indexed_fields = [ "field1" ] compression = "none" default_token = "${SPLUNK_HEC_TOKEN}" [sinks.my_sink_id.encoding] codec = "json" |