Skip to main content
To receive events from FalconFeeds, you first need to configure an HTTP Event Collector (HEC) in your Splunk instance and retrieve its URL and token.

​
Creating a HEC Token

  1. In your Splunk instance, navigate to the main dashboard and select Settings → Data Inputs.
Navigating to Settings > Data Inputs in Splunk
  1. Under Local inputs, select HTTP Event Collector.
Selecting HTTP Event Collector under Local inputs
  1. Click Global Settings in the top-right corner.
    • Ensure All Tokens is set to Enabled
    • Note the HEC Port Number (the default is 8080)
    • Click Save
Configuring Global Settings for HEC
  1. Return to the HEC page and click New Token. On the Select Source step, provide a name for your token and click Next.
Creating a new HEC token and providing a name
  1. On the Input Settings step, select a Source type. FalconFeeds sends JSON events - select a JSON-compatible source type or create a new one as needed. Then select the index where you want to receive events. Multiple indexes can be allowed.
Configuring source type and index
If no index is specified during integration, FalconFeeds sends events to the main index by default.
  1. Click Review and then Submit. Splunk will generate a token value - copy it for use in the next step.
Copying the generated HEC token

​
HEC URL Format

Your HEC URL will follow one of these formats:
For JSON events specifically:
TLS certificate verification is not performed at this time. Ensure your environment accounts for this.