We have updated our Terms of Service, Code of Conduct, and Addendum.

HEC Source, what is the service endpoint?


Hi all, Setting up my first HEC source within Cribl. I'm sending json from Corelight to this new HEC source. Should the HEC services endpoint within Cribl be "/services/collector/event" or "/services/event" ?


  • Brandon McCombs

    by default the HEC input is configured to use `/services/collector/` as the base endpoint url so you'd append `event` or `raw` to that for the full url.