---
title: "Add an HEC token and optional metadata to a Splunk HEC Source within a Pack"
method: POST
path: "/p/{pack}/system/inputs/{id}/hectoken"
tags: ["sources"]
---

# Add an HEC token and optional metadata to a Splunk HEC Source within a Pack

`POST /p/{pack}/system/inputs/{id}/hectoken`

Add an HEC token and optional metadata to the specified Splunk HEC Source within the specified Pack.

## Path parameters

- `id` string, required
- `pack` string, required

## Request body

- AddHecTokenRequest
  - `allowedIndexesAtToken` string[] — List of index names that the HEC token is allowed to write to.
  - `description` string — Brief description for the HEC token.
  - `enabled` boolean — If <code>true</code>, the HEC token is enabled. Otherwise, <code>false</code>.
  - `metadata` MetadataConfAddHecTokenRequest[] — Array of key-value pairs to associate with the HEC token for tagging, categorization, or providing additional context. Each item in the array is an object with a <code>name</code> and a <code>value</code>.
    - `name` string, required
    - `value` string, required
  - `token` string, required — The HEC token value to add to the Splunk HEC Source.

## Response `200`

The updated Splunk HEC Source with the new HEC token.

- CountedInputSplunkHec
  - `count` integer, required — number of items present in the items array
  - `items` InputSplunkHec[], required — List of items in this response.
    - `id` string — Unique ID for this input
    - `type` 'splunk_hec', required — Source type identifier.
    - `disabled` boolean — If true, the Source is disabled and will not collect data.
    - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes
    - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations.
    - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere.
    - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers).
    - `streamtags` string[] — Metadata tags used for categorization and filtering.
    - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create.
      - `origin` 'data_source_discovery' — Feature that created the Source.
      - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source.
      - `sourceArn` string — ARN of the AWS resource that produces the logs.
    - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack
      - `pipeline` string — Pipeline or Pack to process data before sending to the Destination.
      - `output` string — Destination to send data to when not using Routes.
    - `pq` PqType
      - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine.
      - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB.
      - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead.
      - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them
      - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc.
      - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc.
      - `path` string — The location for the persistent queue files. To this field's value, the system will append: /<worker-id>/inputs/<input-id>
      - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data
      - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged.
      - `pqControls` object — Management controls for the persistent queue.
    - `host` string, required — Address to bind on. Defaults to 0.0.0.0 (all addresses).
    - `port` number, required — Port to listen on
    - `authTokens` object[] — Shared secrets to be provided by any client (Authorization: <token>). If empty, unauthorized access is permitted.
      - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate
      - `tokenSecret` string — Select or create a stored text secret
      - `token` string, required — Shared secret to be provided by any client (Authorization: <token>)
      - `enabled` boolean — If true, the token is active and can be used for authentication.
      - `description` string — Optional token description
      - `allowedIndexesAtToken` string[] — Enter the values you want to allow in the HEC event index field at the token level. Supports wildcards. To skip validation, leave blank.
      - `metadata` MetadataConfInputCollection[] — Fields to add to events referencing this token
        - `name` string, required — Name of the metadata field.
        - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.)
    - `tls` TlsSettingsServerSideType — TLS settings (server side)
      - `disabled` boolean — If true, TLS is disabled on this connection.
      - `requestCert` boolean — Require clients to present their certificates. Used to perform client authentication using SSL certs.
      - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's)
      - `commonNameRegex` string — Regex matching allowable common names in peer certificates' subject attribute
      - `certificateName` string — The name of the predefined certificate
      - `privKeyPath` string — Path on server containing the private key to use. PEM format. Can reference $ENV_VARS.
      - `passphrase` string — Passphrase to use to decrypt private key
      - `certPath` string — Path on server containing certificates to use. PEM format. Can reference $ENV_VARS.
      - `caPath` string — Path on server containing CA certificates to use. PEM format. Can reference $ENV_VARS.
      - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version
      - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version
    - `maxActiveReq` number — Maximum number of active requests allowed per Worker Process. Set to 0 for unlimited. Caution: Increasing the limit above the default value, or setting it to unlimited, may degrade performance and reduce throughput.
    - `maxRequestsPerSocket` integer — Maximum number of requests per socket before @{product} instructs the client to close the connection. Default is 0 (unlimited).
    - `enableProxyHeader` boolean — Extract the client IP and port from PROXY protocol v1/v2. When enabled, the X-Forwarded-For header is ignored. Disable to use the X-Forwarded-For header for client IP extraction.
    - `captureHeaders` boolean — Add request headers to events, in the __headers field
    - `activityLogSampleRate` number — How often request activity is logged at the `info` level. A value of 1 would log every request, 10 every 10th request, etc.
    - `requestTimeout` number — How long to wait for an incoming request to complete before aborting it. Use 0 to disable.
    - `socketTimeout` number — How long @{product} should wait before assuming that an inactive socket has timed out. To wait forever, set to 0.
    - `keepAliveTimeout` number — After the last response is sent, @{product} will wait this long for additional data before closing the socket connection. Minimum 1 second, maximum 600 seconds (10 minutes).
    - `ipAllowlistRegex` string — Messages from matched IP addresses will be processed, unless also matched by the denylist
    - `ipDenylistRegex` string — Messages from matched IP addresses will be ignored. This takes precedence over the allowlist.
    - `splunkHecAPI` string, required — Absolute path on which to listen for the Splunk HTTP Event Collector API requests. This input supports the /event, /raw and /s2s endpoints.
    - `metadata` MetadataConfInputCollection[] — Fields to add to every event. Overrides fields added at the token or request level. See [the Source documentation](https://docs.cribl.io/stream/sources-splunk-hec/#fields) for more info.
      - `name` string, required — Name of the metadata field.
      - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.)
    - `allowedIndexes` string[] — List values allowed in HEC event index field. Leave blank to skip validation. Supports wildcards. The values here can expand index validation at the token level.
    - `splunkHecAcks` boolean — Enable Splunk HEC acknowledgements
    - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream
    - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines
    - `useFwdTimezone` boolean — Event Breakers will determine events' time zone from UF-provided metadata, when TZ can't be inferred from the raw event
    - `dropControlFields` boolean — Drop Splunk control fields such as `crcSalt` and `_savedPort`. If disabled, control fields are stored in the internal field `__ctrlFields`.
    - `extractMetrics` boolean — Extract and process Splunk-generated metrics as Cribl metrics
    - `accessControlAllowOrigin` string[] — Optionally, list HTTP origins to which @{product} should send CORS (cross-origin resource sharing) Access-Control-Allow-* headers. Supports wildcards.
    - `accessControlAllowHeaders` string[] — Optionally, list HTTP headers that @{product} will send to allowed origins as "Access-Control-Allow-Headers" in a CORS preflight response. Use "*" to allow all headers.
    - `emitTokenMetrics` boolean — Emit per-token (<prefix>.http.perToken) and summary (<prefix>.http.summary) request metrics
    - `description` string — Optional description for this configuration.
    - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime.
    - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime.
    - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime.
    - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime.
    - `__template_splunkHecAPI` string — Binds 'splunkHecAPI' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'splunkHecAPI' at runtime.

## Other responses

- `400` — Failed validation or malformed input — Source not found, source type is not <code>splunk_hec</code>, or request payload is invalid.
- `401` — Authentication failed (missing or invalid credentials or Bearer token).
- `500` — Unexpected server error.

---

[API](https://skmtc.net/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.net/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/versions/e9bef570d106/schema)