NAME

Splunk::HEC - A simple wrapper for the Splunk HTTP Event Collector (HEC) API

SYNOPSIS

use Splunk::HEC;

my $hec = Splunk::HEC->new(
  url => 'https://mysplunkserver.example.com:8088/services/collector/event',
  token => '12345678-1234-1234-1234-1234567890AB'
);

my $res = $hec->send(event => {message => 'Something happened', severity => 'INFO'});
if ($res->is_success)  { say $res->content }
elsif ($res->is_error) { say $res->reason }

DESCRIPTION

Splunk::HEC is a simple HTTP client wrapper for the Splunk HEC API;

ATTRIBUTES

Splunk::HEC implements the following attributes.

url

my $url = $hec->url;
$url   = $hec->url('https://mysplunkserver.example.com:8088/services/collector/event');

Full URL to Splunk HEC endpoint (required).

token

my $token = $hec->token;
$token   = $hec->token('12345678-1234-1234-1234-1234567890AB');

Splunk HEC authentication token (required)

timeout

my $timeout = $hec->timeout;
$timeout = $hec->timeout(300);

Timeout in seconds when talking to Splunk HEC. (optional, default 60s)

METHODS

Splunk::HEC implements the following methods.

new

my $hec = Splunk::HEC->new;
my $hec = Splunk::HEC->new(url => 'value', token => 'value');
my $hec = Splunk::HEC->new({name => 'value'});

This is the constructor used to create the Splunk::HEC object. You can pass it either a hash or a hash reference with attribute values.

send

# single event
$res = $hec->send(event => 'event1', time => $epoch, source => 'datasource', sourcetype => '', index => 'data-index');

# multiple events (array of hashrefs)
$res = $hec->send(
  {event => 'event1', time => $epoch, source => 'datasource', sourcetype => '', index => 'data-index'},
  {event => 'event2', time => $epoch, source => 'datasource', sourcetype => '', index => 'data-index'}
);

Send one or more events to HEC. If multiple events are provided at once, they are sent using HEC batch mode. Passed events are converted into Splunk::HEC::Request objects prior to being encoded and sent. Once HEC responds, it returns a Splunk::HEC::Response object.

See the attributes of Splunk::HEC::Request for supported event attributes and default settings.

client

my $hec = Splunk::HEC->new;
my $client = $hec->client;

Returns the HTTP client

ENVIRONMENT VARIABLES

Splunk::HEC provides configuration via the following environment variables.

SPLUNK_HEC_URL