What is required to setup the HTTP Event Collector (HEC)?

Question

Options

• AEach HEC input requires a unique name but token values can be shared.
• BEach HEC input requires an existing forwarder output group.
• CEach HEC input entry must contain a valid token.
• DEach HEC input requires a Source name field.

• B
  3% (1)
• C
  94% (32)
• D
  3% (1)

Explanation

Setting up HEC in Splunk requires each input entry to have a valid token - the token is the authentication credential that authorizes data senders to push events to Splunk, making it the one non-negotiable field. Without a token, the HEC input cannot function at all.

Why the distractors are wrong:

• A is incorrect because tokens must be unique per HEC input; sharing tokens would undermine per-source access control and auditing.
• B is incorrect because HEC inputs receive data directly over HTTP/HTTPS and do not depend on forwarder output groups, which are a Universal Forwarder concept.
• D is incorrect because the Source name field is optional metadata - Splunk can derive or assign source values automatically if not specified.

Memory tip: Think of the HEC token like an API key - you can't make an authenticated API call without one. Every HEC input needs its own key (token) to open the door; everything else is optional configuration.

No community discussion yet for this question.