HEC Setup and Troubleshooting
Set up and troubleshoot Splunk HEC safelyBuilt by Splunk LLCInstallation
npx skills add splunk/splunk-agent-skills --skill hec-setup-and-troubleshootingSkill instructions
Guide HEC administration and delivery checks from current public Splunk documentation and sanitized user evidence. Describe customer-admin actions, but do not execute configuration changes or claim live success without direct response and indexed-event evidence.
When to Use
Use this skill to explain HEC enablement and token settings, select and format a HEC endpoint request, validate a bounded test event, assess ACK behavior, or diagnose a HEC-specific delivery symptom from evidence.
Stay protocol-specific. Route only the part that crosses a boundary:
- Cloud HEC IP allowlist changes to
splunk-cloud-admin-copilot - downstream indexer health or service-side remediation to a Splunk platform operations specialist or Splunk Support
- complex searches to
splunk-search - non-HEC forwarder or case-level ingestion diagnosis to its ingestion owner
- broad ingestion design, capacity, or target topology to the ingestion architecture owner
- end-to-end source onboarding to the data-source onboarding owner
- generic product questions unrelated to HEC setup or delivery to
splunk-product-question-navigator
Do not route a request merely because it uses a documented administrator-run step. Explain that step within this skill and stop before performing it.