Splunk Hec Service Setup

Splunk HEC Service Setup

Prerequisites

Workflow Overview

┌───────────┐   ┌───────────────┐   ┌───────────────┐   ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘   └───────────────┘   └───────────────┘   └─────────────────┘

When to Activate

• The user asks for reusable HEC token management, inputs.conf rendering, ACS HEC tokens, allowed index restrictions, indexer acknowledgement, HEC port/TLS settings, or a shared ingestion endpoint for apps and external collectors.
• Preview and review the splunk hec service setup workflow before any live apply phase.
• Diagnose failed prerequisites, generated assets, configuration, or validation evidence.

Scope

Follow the documented read-only or render-first path whenever it is available. This skill does not imply permission to mutate live systems. Require explicit apply flags, protected credentials, and operator review for state changes.

Examples

Inspect the supported setup modes before selecting one:

bash skills/splunk-hec-service-setup/scripts/setup.sh --help

Expected output: usage, supported modes, and required arguments are displayed without changing the target environment.

Inspect validation modes before running completion checks:

bash skills/splunk-hec-service-setup/scripts/validate.sh --help

Expected output: offline, live, and completion options are displayed when the skill supports them; help exits without mutation.

Troubleshooting

This skill prepares a reusable Splunk HTTP Event Collector service. It renders reviewable Enterprise inputs.conf assets and Splunk Cloud ACS payloads without placing token values in chat, metadata, or command-line arguments.

Agent Behavior

Never ask for HEC token values in chat. Use file-based token handling:

bash skills/shared/scripts/write_secret_file.sh /tmp/app_hec_token

Use template.example for non-secret values:

• platform
• token name
• default and allowed indexes
• source and sourcetype defaults
• HEC port and TLS mode
• whether indexer acknowledgement is appropriate
• token-file paths

Quick Start

Render Enterprise HEC assets:

bash skills/splunk-hec-service-setup/scripts/setup.sh \
  --platform enterprise \
  --token-name app_hec \
  --default-index app \
  --allowed-indexes app,summary

Apply on a Splunk Enterprise HEC tier after review:

bash skills/splunk-hec-service-setup/scripts/setup.sh \
  --platform enterprise \
  --phase apply \
  --token-file /tmp/app_hec_token \
  --token-name app_hec \
  --default-index app \
  --allowed-indexes app,summary

Create or update a Splunk Cloud HEC token through ACS:

bash skills/splunk-hec-service-setup/scripts/setup.sh \
  --platform cloud \
  --phase apply \
  --write-token-file /tmp/app_hec_token \
  --token-name app_hec \
  --default-index app \
  --allowed-indexes app,summary

What It Renders

• inputs.conf.template for Enterprise splunk_httpinput/local
• acs-hec-token.json for the ACS HEC token API shape
• acs-hec-token-bulk.json for ACS CLI bulk workflows
• helper scripts for preflight, Enterprise apply, Cloud ACS apply, and status

Enterprise apply substitutes the token from a local token file at apply time. Cloud apply lets ACS create the token value and writes it to a local-only file only when requested.

Enterprise apply merges the managed [http] and token settings into the target inputs.conf, preserving unrelated stanzas and settings and retaining a dated backup. Cloud apply fails closed if the installed ACS command group cannot enforce a requested field. If --write-token-file is requested, creation is incomplete and returns nonzero unless the one-time value is actually written. For an existing Cloud token, ACS cannot return the stored secret; a requested token-output path must therefore already contain a nonempty owner-only value or the apply script emits a rotation handoff and exits nonzero.

Read reference.md before enabling useACK or deploying to clustered Enterprise HEC tiers.