Migrate from Splunk HEC

Squasher has no Splunk HEC endpoint, so a HEC client cannot send to Squasher directly. Put an OpenTelemetry Collector in the middle: it receives HEC events and sends them to Squasher over OTLP.

What moves and what does not

In Splunk	In Squasher	Notes
HEC events (`/services/collector/event`)	Logs	The `event` value becomes the log body, and `fields` become log attributes.
Raw HEC data (`/services/collector/raw`)	Logs	The Collector makes one log from each line.
`host`, `source`, `sourcetype`, `index`	Resource attributes	`host.name`, `com.splunk.source`, `com.splunk.sourcetype`, and `com.splunk.index`.
HEC tokens	Ingest key	The Collector sends to Squasher with a Squasher ingest key.
Severity	Log level	HEC events have no level. Set it in the Collector, or no event opens an issue.
SPL searches, dashboards, and alerts	Not imported	Recreate the ones that your team uses.

Run both tools side by side

The Collector can send each event to Squasher and to Splunk. Point your HEC clients at the Collector, and keep the splunk_hec exporter in the config below until you turn off Splunk.

Switch the endpoint

Configure the Collector

Use a recent otelcol-contrib build. It includes the splunk_hec receiver and exporter.

otel-collector-config.yaml

receivers:
  splunk_hec:
    endpoint: 0.0.0.0:8088

processors:
  transform/severity:
    error_mode: ignore
    log_statements:
      - set(log.severity_text, "ERROR") where log.attributes["level"] == "error"
      - set(log.severity_number, SEVERITY_NUMBER_ERROR) where log.attributes["level"] == "error"
  batch: {}

exporters:
  otlphttp/squasher:
    endpoint: https://ingest.squasher.ai
    headers:
      x-squasher-key: ${env:SQUASHER_API_KEY}
  splunk_hec:
    token: ${env:SPLUNK_HEC_TOKEN}
    endpoint: https://splunk.example.com:8088/services/collector

service:
  pipelines:
    logs:
      receivers: [splunk_hec]
      processors: [transform/severity, batch]
      exporters: [otlphttp/squasher, splunk_hec]

The transform reads the level from a HEC field named level. Change the condition to match where your events keep it. Squasher opens issues for logs at ERROR or FATAL.

Start the Collector

Set SQUASHER_API_KEY and SPLUNK_HEC_TOKEN in the Collector’s environment, then start it:

otelcol-contrib --config otel-collector-config.yaml

Point your HEC clients at the Collector

Change the HEC URL in each client from Splunk to the Collector, for example http://otel-collector:8088/services/collector/event. Keep the Authorization: Splunk ... header. The clients do not need other changes.

Send a test event

curl http://otel-collector:8088/services/collector/event \
  -H "Authorization: Splunk $SPLUNK_HEC_TOKEN" \
  -d '{"host": "web-1", "sourcetype": "checkout", "event": "Payment failed", "fields": {"level": "error"}}'

Select Logs in the Squasher sidebar to see the log, then Issues to see the issue.

By default, the splunk_hec receiver does not check HEC tokens. Run the Collector on a private network, or put it behind a proxy that checks them.

Check parity

Compare Splunk and Squasher for at least one week that includes a deploy:

The number of events per sourcetype each hour.
The events at error level, and the issues that they opened in Squasher.
The host.name and com.splunk.sourcetype values on the logs.

Turn off Splunk

Recreate the Splunk alerts that you need as monitors and notification routes.
Remove the splunk_hec exporter from the Collector, and restart it.
Remove the HEC tokens that no client uses anymore.

Next steps

OpenTelemetry

Send logs, traces, and metrics over OTLP.

HTTP API

Post JSON logs to Squasher without a Collector.

Add monitors

Open incidents from log queries and checks.

Set up notifications

Send incidents to Slack, email, or PagerDuty.

Get started

Guides

Migrate from Splunk HEC

What moves and what does not

Run both tools side by side

Switch the endpoint

Check parity

Turn off Splunk

Next steps

OpenTelemetry

HTTP API

Add monitors

Set up notifications

​What moves and what does not

​Run both tools side by side

​Switch the endpoint

​Check parity

​Turn off Splunk

​Next steps

OpenTelemetry

HTTP API

Add monitors

Set up notifications

What moves and what does not

Run both tools side by side

Switch the endpoint

Check parity

Turn off Splunk

Next steps