Skip to main content
Squasher does not expose a dedicated Splunk HEC endpoint yet. Use this path when you want to migrate a Splunk HEC source into Squasher:
  1. Create either an HTTP API connector or OTLP HTTP connector in Squasher.
  2. Keep the old Splunk destination active during a short validation window.
  3. Re-map the outgoing collector payload so it emits structured JSON or OTLP to Squasher.
  4. Compare event counts, levels, and key tags before cutover.
For most teams, the cleanest target is HTTP API. If you already use an observability pipeline, Vector is usually the fastest migration layer.

​
Compatibility boundaries

  • No dedicated Splunk HEC endpoint yet
  • Tokens, indexes, and sourcetypes must be translated at the collector or gateway layer
  • Search, dashboards, and alert semantics move to Squasher after cutover

​
Field mapping

  • HEC event -> message plus structured fields
  • HEC host -> tags.host
  • HEC source -> tags.source
  • HEC sourcetype -> tags.sourcetype
  • HEC timestamp -> timestamp

​
Troubleshooting

  • Confirm your translator preserves error level and service tags
  • Send one representative HEC envelope first, then widen batching
  • Compare event counts during dual-ship before retiring the Splunk destination

​
Agent handoff