Splunk Output Plugin: non-standart endpoints

[denis-shuvalov]

Hello!
I have a question related to customization of the default endpoints of Splunk HTTP Event Collector(HEC).
I use Splunk Output Plugin to send logs to Splunk Cloud Platform and Splunk Enterprise.
How I've got from the Docs, it is possible to set Splunk HOST and PORT in the configuration file. But ENDPOINTS are being set automatically to "/services/collector/raw" or "/services/collector/event".
But I have a specific case where I have to send data to non-standart endpoints, such as "/subfolder/services/collector/raw".
Is there a way to configure such non-standart endpoints via Fluentbit config file or somehow else? Or maybe there is some setting for adding "subfolder" to the endpoints?

Thank you!

[agup006]

The splunk output plugin is currently hardcoded, however you can use the out_http plugin and customize the URI and other settings to get a similar result at the moment.

Also open to a PR to expose URI as a configuration parameter if you are able to contribute it @denis-shuvalov

[denis-shuvalov]

Thank you!

[isshwar]

@agup006 could you give the config on how to use out_http plugin for an https host. when I try to use out_http plugin, the fqdn is set to http://<splunk_host>:443 rather than https://<splunk_host>

Thanks

[patrick-stephens]

You need to use the TLS settings to turn on TLS, see https://docs.fluentbit.io/manual/administration/transport-security