Splunk
Send Splunk HEC events to RawTree and search them with SPL.
Splunk
RawTree provides Splunk HTTP Event Collector (HEC)-compatible ingestion and a platform-native SPL search experience. You do not need to install a Splunk search provider, command, forwarder, or add-on to query the ingested events.
Before using these endpoints, open the cluster in the RawTree platform, select Apps, and install Splunk. Installation enables HEC ingestion, SPL execution, and saved searches for the cluster. It does not start or resume the cluster, so the cluster must also be available.
HEC ingestion
Use a writable cluster API key as the HEC token and select the destination
database with the database query parameter:
export RAWTREE_URL=https://api.rawtree.com
export RAWTREE_API_KEY=rt_...
export RAWTREE_DATABASE=analytics
curl -X POST "$RAWTREE_URL/splunk/services/collector/event?database=$RAWTREE_DATABASE" \
-H "Authorization: Splunk $RAWTREE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"time": 1710000000,
"host": "web-01",
"source": "nginx",
"sourcetype": "access_combined",
"index": "main",
"event": {"status": 200, "path": "/health", "duration_ms": 12}
}'RawTree creates the splunk_events table on the first successful insert. Event
object fields and HEC metadata are queryable as top-level fields. RawTree also
adds _time and retains the original HEC envelope in _hec. The HEC index
field is searchable metadata; it does not create another RawTree table.
The supported HEC endpoints are:
| Endpoint | Purpose |
|---|---|
POST /splunk/services/collector | Ingest one or more HEC event envelopes. |
POST /splunk/services/collector/event | Ingest one or more HEC event envelopes. |
POST /splunk/services/collector/raw | Ingest newline-delimited raw events. Requires a UUID channel in X-Splunk-Request-Channel or channel. |
GET /splunk/services/collector/health | Check HEC connectivity. |
GET /splunk/services/collector/health/1.0 | Check HEC connectivity using the versioned path. |
Search with SPL
Open Splunk under Apps in the sidebar to create, run, and save SPL
searches in the RawTree platform. Searches run directly against
splunk_events, and results include a timeline plus row-count feedback for
supported pipeline stages.
You can also execute a read-only search through the API:
curl -X POST \
"$RAWTREE_URL/v1/spl/search?database=$RAWTREE_DATABASE" \
-H "Authorization: Bearer $RAWTREE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"spl": "index=main status>=500 | stats count by host | sort - count",
"earliest": "-30m",
"latest": "now"
}'The supported SPL subset includes base filters; search and where; positive
fields and table; rename; bounded eval; stats; sort; head;
multi-field dedup; and timechart. Unsupported or ambiguous commands return
400 instead of being passed through as SQL.
The search response includes the result rows, the original SPL, timeline buckets, pipeline-stage feedback, result kind, truncation state, and query statistics. For the complete request and response contract, supported aggregations, time-window syntax, cancellation, and saved-search endpoints, see the Splunk and SPL search API reference.