fluent-plugin-splunk-hec-radiant

A modernized and actively maintained Fluentd output plugin for sending events and metrics to Splunk via the HTTP Event Collector (HEC) API.

This is a fork of the original fluent-plugin-splunk-hec by Splunk Inc., which has reached end-of-support. This version includes:

• ✅ Ruby 3.x support (requires Ruby 3.0+)
• ✅ Modern dependencies (Fluentd 1.16+, latest gems)
• ✅ Better performance (using oj for JSON instead of multi_json)
• ✅ Enhanced security (TLS 1.2+ by default)
• ✅ Active maintenance and bug fixes
• ✅ Comprehensive test coverage

gem install fluent-plugin-splunk-hec-radiant

Add to your Gemfile:

gem "fluent-plugin-splunk-hec-radiant"

Then run:

bundle install

td-agent-gem install fluent-plugin-splunk-hec-radiant

The plugin is registered as @type splunk_hec_radiant.

<match **>
  @type splunk_hec_radiant
  hec_host 12.34.56.78
  hec_port 8088
  hec_token 00000000-0000-0000-0000-000000000000
</match>

This sends events to Splunk HEC at https://12.34.56.78:8088 using the specified token.

<match **>
  @type splunk_hec_radiant
  
  # HEC endpoint configuration
  protocol https
  hec_host splunk.example.com
  hec_port 8088
  hec_token "#{ENV['SPLUNK_HEC_TOKEN']}"
  hec_endpoint services/collector
  
  # Splunk indexing parameters
  index main
  source ${tag}
  sourcetype _json
  host myapp-server-01
  
  # TLS/SSL configuration
  insecure_ssl false
  require_ssl_min_version true  # Enforces TLS 1.2+
  ca_file /path/to/ca_bundle.crt
  # client_cert /path/to/client.crt
  # client_key /path/to/client.key
  
  # Performance tuning
  gzip_compression true
  idle_timeout 5
  open_timeout 10
  read_timeout 10
  
  # Error handling
  consume_chunk_on_4xx_errors true
  coerce_to_utf8 true
  non_utf8_replacement_string " "
  
  # Custom headers
  <custom_headers>
    X-Custom-Header value
  </custom_headers>
  
  # Index-time fields
  <fields>
    environment production
    application myapp
  </fields>
</match>

To send metrics to a Splunk metrics index (Splunk 7.0+):

<match metrics.**>
  @type splunk_hec_radiant
  data_type metric
  hec_host splunk.example.com
  hec_token "#{ENV['SPLUNK_HEC_TOKEN']}"
  index metrics_index
</match>

<match metrics.**>
  @type splunk_hec_radiant
  data_type metric
  hec_host splunk.example.com
  hec_token "#{ENV['SPLUNK_HEC_TOKEN']}"
  
  metrics_from_event false
  metric_name_key metric_name
  metric_value_key metric_value
</match>

This plugin is designed as a drop-in replacement for the original fluent-plugin-splunk-hec. To migrate:

1. Update your Gemfile or installation:

   # Old
   # gem "fluent-plugin-splunk-hec"
   
   # New
   gem "fluent-plugin-splunk-hec-radiant"

2. Update your Fluentd configuration:

   <match **>
     # Old
     # @type splunk_hec
     
     # New
     @type splunk_hec_radiant
     
     # ... rest of configuration remains the same
   </match>

3. Verify Ruby version: Ensure you're running Ruby 3.0 or newer.

• Ruby 2.x is no longer supported - Ruby 3.0+ is required
• TLS 1.0/1.1 disabled by default - TLS 1.2+ is enforced when require_ssl_min_version is true
• Dependency changes: Uses oj instead of multi_json (transparent to users)

• Ruby 3.0 or newer
• Bundler 2.0+
• Git

git clone https://github.com/gnanirahulnutakki/fluent-plugin-splunk-hec-radiant.git
cd fluent-plugin-splunk-hec-radiant
bundle install

bundle exec rspec

bundle exec rubocop

bundle exec rake build

The gem will be created in the pkg/ directory.

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

Please ensure:

• Tests pass (bundle exec rspec)
• Code passes linting (bundle exec rubocop)
• New features include tests
• Documentation is updated

Copyright 2025 G. Rahul Nutakki Copyright 2018 Splunk Inc.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

This project is a derivative work of fluent-plugin-splunk-hec by Splunk Inc., which has reached end-of-support. See NOTICE for full attribution details.

• Issues: GitHub Issues
• Documentation: README.md
• Original Plugin: Splunk fluentd-hec (deprecated)

See CHANGELOG.md for version history.