> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/data-sinks-changelog/splunk-hec-data-sink.md).

# Splunk HEC Data Sink

Learn more about this Data sink type in [this article](/data-sinks/data-sink-integrations/send-data-to-splunk.md).

<details>

<summary>v3.0.0</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">06/17/2026</mark>

* New **Enable retry attempts** section to define rules that dictate how the system will automatically re-run failed operations.
* Shared core with Falcon Data Sinks for consistent behavior.
* Implemented retry mechanism.
* Message field now supports literals and default values.
* Bulk time trigger now correctly uses milliseconds.
* Fixed potential data corruption under high concurrency.
* Fixed authentication token handling when token includes a prefix.
* Improved error response handling consistency.

</details>

<details>

<summary>v2.0.1</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">04/30/2026</mark>

#### Enhancements

* Fields now can be sent as its values instead of strings.

#### Bug Fixes

* Fixed race condition causing panics on gzip compression.

</details>

<details>

<summary>v2.0.0</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">12/03/2025</mark>

#### Enhancements

* Add option to send fields
* Redesign user interface
* Move sourceType to pipeline config
* Make channel available for token auth

</details>

<details>

<summary>v1.0.1</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">06/24/2025</mark>

* Better support for batch max size and gzip compression.
* Support authentication tokens not starting with `Splunk`.

</details>

<details>

<summary>v1.0.0</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">04/30/2025</mark>

* Redesigned user interface.
* Added support for mTLS.
* Metadata input fields now support default values and literals.
* Added bulk max size in bytes.

</details>

<details>

<summary>v0.0.5</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">12/15/2024</mark>

* UI improvements to the properties window using conditional fields.

</details>

<details>

<summary>v0.0.4</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">12/02/2024</mark>

* Source type removed and added to the Pipeline configuration.

</details>

<details>

<summary>v0.0.3</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">10/18/2024</mark>

* Splunk Instance URL shouldn't always have to specify port 8088.
* Splunk RAW concatenates logs into a single string.
* Field name included in JSON request removed.

</details>

<details>

<summary>v0.0.2</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">08/05/2024</mark>

Minor bug fixing

</details>

<details>

<summary>v0.0.1</summary>

<mark style="background-color:purple;">**Released on**</mark> <mark style="background-color:purple;"></mark><mark style="background-color:purple;">05/13/2024</mark>

Initial version

</details>