Cribl - Docs

Getting started with Cribl LogStream

Questions? We'd love to help you! Meet us in #cribl (sign up)
Download manual as PDF


Splunk HEC

Splunk HEC is a streaming destination type. In a typical deployment, Cribl will be installed/co-located in a Splunk heavy forwarder and if this output is enabled it can send data out to a Splunk HEC destination thru the event endpoint.

Configuring Cribl to output to Splunk HEC destinations

While on Destinations screen, select Splunk HEC from the vertical menu, then click Add New:

  • Output Id: Enter a unique name to identify this Splunk HEC destination definition.
  • Splunk HEC Endpoint: URL to an Splunk HEC endpoint where to send events, e.g.
  • HEC Auth Token: Splunk HEC authentication token.
  • Next Processing Queue: Specify the next Splunk processing queue to send the events after HEC processing. Defaults to indexQueue.
  • . Default _TCP_ROUTING: Specify the value of _TCP_ROUTING field for events that do not have _ctrl._TCP_ROUTING set. Defaults to nowhere. Note: this is useful only when this data is expected to be further routed to another destination by the HEC receiver.
  • Request Concurrency: Maximum number of ongoing requests before blocking. Defaults to 5.
  • Max Body Size (KB): Maximum size, in KB, of the request body. Defaults to 4096.
  • Flush Period (s): Maximum time between requests. This could cause the payload size to be smaller than max. Defaults to 1.
  • Extra HTTP Headers: Name/Value pairs to pass as additional HTTP headers.

Then, click Save.

Notes on HTTP based outputs

  • Cribl will attempt to use keepalives to reuse a connection for multiple requests. After 2 minutes of the first use, the connection will be thrown away and a new one will be reattempted. This is to prevent sticking to a particular destination when there is a constant flow of events.
  • If keepalives are not supported by the server (or if the server closes a pooled connection while idle) a new connection will be established for next request.
  • When resolving destination's hostname Cribl will pick the first IP in the list for use in the next connection. Round-robin DNS would help with event balancing.

Splunk HEC

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.