The token used to send events to Splunk through the HTTP Event Collector (HEC).

Data Type

string

Default Value

""

Remarks

This token applies only when AuthScheme is set to HTTPEventCollectorToken. It is used exclusively to send events through the Splunk HTTP Event Collector (HEC) and enables only the CreateHTTPEvent stored procedure; you cannot query tables or views, run searches, or perform any other operation with it.

Obtain the token in the Splunk UI under Data Inputs > HTTP Event Collector.

Note: Before you use this token, the HTTP Event Collector must be enabled on your Splunk instance, and the IP address of the machine running the connector (or, in a hosted environment, the egress IP addresses of the host) must be allowed in the HTTP Event Collector configuration on the Splunk side. Otherwise, requests are rejected.