> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squasher.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk HEC Migration

> Move Splunk HEC style shipping onto Squasher's HTTP API or OTLP path.

Squasher does not expose a dedicated Splunk HEC endpoint yet.

Use this path when you want to migrate a Splunk HEC source into Squasher:

1. Create either an HTTP API connector or OTLP HTTP connector in Squasher.
2. Keep the old Splunk destination active during a short validation window.
3. Re-map the outgoing collector payload so it emits structured JSON or OTLP to Squasher.
4. Compare event counts, levels, and key tags before cutover.

For most teams, the cleanest target is [HTTP API](/integrations/http-api). If you already use an observability pipeline, [Vector](/integrations/vector) is usually the fastest migration layer.

## Compatibility boundaries

* No dedicated Splunk HEC endpoint yet
* Tokens, indexes, and sourcetypes must be translated at the collector or gateway layer
* Search, dashboards, and alert semantics move to Squasher after cutover

## Field mapping

* HEC `event` -> `message` plus structured fields
* HEC `host` -> `tags.host`
* HEC `source` -> `tags.source`
* HEC `sourcetype` -> `tags.sourcetype`
* HEC timestamp -> `timestamp`

## Troubleshooting

* Confirm your translator preserves error level and service tags
* Send one representative HEC envelope first, then widen batching
* Compare event counts during dual-ship before retiring the Splunk destination

## Agent handoff

```text theme={null}
Plan a Splunk HEC style migration into Squasher for project <project_id>. Choose HTTP API or OTLP, map HEC fields to Squasher fields, test one representative envelope, compare counts during dual-ship, and ask before retiring the old destination.
```