> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk HEC source plugin

export const entity_0 = "Splunk HEC source plugin"

export const plugin_0 = "Splunk HEC source plugin"

The Splunk HEC [source plugin](/ingest/pipeline/plugins/source-plugins)
(name: `splunk`, alias: `splunk_hec`) lets you ingest log data from the Splunk
HTTP Event Collector into a telemetry pipeline.

This is a [push-based](/ingest/pipeline/plugins/source-plugins#push-based-and-pull-based-source-plugins) source plugin.

## Supported telemetry types

The {plugin_0} for Chronosphere Telemetry Pipeline supports these telemetry types:

|                    Logs                    |             Metrics             |              Traces             |
| :----------------------------------------: | :-----------------------------: | :-----------------------------: |
| <Icon icon="circle-check" color="green" /> | <Icon icon="ban" color="red" /> | <Icon icon="ban" color="red" /> |

## Configuration parameters

Use the parameters in this section to configure the {entity_0}. The
Telemetry Pipeline web interface uses the items in the **Name** column to
describe these parameters. [Pipeline configuration files](/ingest/pipeline/v2/configure/config-files)
use the items in the **Key** column as YAML keys.

### General

| Name                     | Key                 | Description                                                                                                                                                                                                                                                                            | Default   |
| ------------------------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| **Address to Listen On** | `listen`            | Required. The address to listen on.                                                                                                                                                                                                                                                    | `0.0.0.0` |
| **Port**                 | `port`              | Required. The port for Telemetry Pipeline to listen on.                                                                                                                                                                                                                                | `9880`    |
| **Tag Key**              | `tag_key`           | Specifies the key name to overwrite a tag. If set, the value of that key overwrites the tag.                                                                                                                                                                                           | *none*    |
| **Buffer Max Size**      | `buffer_max_size`   | Sets the maximum [chunk](https://docs.fluentbit.io/manual/administration/buffering-and-storage#chunks) size for buffered data. If a single record exceeds this size, the plugin drops that record.                                                                                     | `4M`      |
| **Buffer Chunk Size**    | `buffer_chunk_size` | Required. Sets the default [chunk](https://docs.fluentbit.io/manual/administration/buffering-and-storage#chunks) size for buffered data. If a single record exceeds this size, the plugin temporarily increases the chunk size up to the value of `buffer_max_size` to accommodate it. | `512K`    |
| **Splunk Token**         | `splunk_token`      | Your Splunk token for HTTP HEC.                                                                                                                                                                                                                                                        | *none*    |

### Security and TLS

| Name                           | Key              | Description                                                                                                                                               | Default |
| ------------------------------ | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| **TLS**                        | `tls`            | If `true`, enables TLS/SSL. If `false`, disables TLS/SSL. Accepted values: `true`, `false`.                                                               | `false` |
| **TLS Certificate Validation** | `tls.verify`     | If `on`, and if `tls` is `true`, enables TLS/SSL certificate validation. If `off`, disables TLS/SSL certificate validation. Accepted values: `on`, `off`. | `on`    |
| **TLS Debug Level**            | `tls.debug`      | Sets TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational), `4` (Verbose).                     | `1`     |
| **CA Certificate File Path**   | `tls.ca_file`    | Absolute path to CA certificate file.                                                                                                                     | *none*  |
| **Certificate File Path**      | `tls.crt_file`   | Absolute path to certificate file.                                                                                                                        | *none*  |
| **Private Key File Path**      | `tls.key_file`   | Absolute path to private key file.                                                                                                                        | *none*  |
| **Private Key Path Password**  | `tls.key_passwd` | Password for private key file.                                                                                                                            | *none*  |
| **TLS SNI Hostname Extension** | `tls.vhost`      | Hostname to be used for TLS SNI extension.                                                                                                                | *none*  |

### Advanced

| Name                    | Key             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Default |
| ----------------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| **Memory Buffer Limit** | `mem_buf_limit` | For pipelines with the Deployment or DaemonSet [workload](/ingest/pipeline/v2/configure/kubernetes/workloads) type only. Sets a limit for how much buffered data the plugin can write to memory, which affects [backpressure](/ingest/pipeline/v2/configure/backpressure). This value must follow Fluent Bit's rules for [unit sizes](https://docs.fluentbit.io/manual/administration/configuring-fluent-bit#unit-sizes). If unspecified, no limit is enforced. | *none*  |