GreptimeTeam/greptimedb

Support Splunk HEC-compatible ingestion endpoint

Open

#8,216 opened on Jun 2, 2026

View on GitHub
 (6 comments) (0 reactions) (0 assignees)Rust (495 forks)github user discovery
A-frontendC-featurehelp wanted

Repository metrics

Stars
 (6,332 stars)
PR merge metrics
 (PR metrics pending)

Description

What problem does the new feature solve?

Consider adding support for a Splunk HEC-compatible ingestion endpoint in GreptimeDB.

Motivation

Splunk HEC is a common HTTP-based protocol for log and event ingestion. Supporting it would make it easier for users to:

  • migrate from Splunk
  • reuse existing agents, scripts, and pipelines
  • integrate GreptimeDB with tools that already support HEC

What does the feature do?

Support a basic compatible endpoint such as:

/v1/splunk/services/collector/event

With:

  • token-based authentication
  • JSON event ingestion
  • batched payloads
  • basic field mapping for time, host, source, sourcetype, and event
  • pipeline supporting

Implementation challenges

No response

Contributor guide

Research direction
Study the Splunk HEC protocol and GreptimeDB's existing ingestion pipeline to design an endpoint that maps HEC fields to GreptimeDB's schema.
Tech stack
rust
Domain
backendapi
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
RustHTTPSplunk HEC
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40