node-red-contrib-splunk-hec 0.1.7

Node-RED node for sending events to Splunk HEC

npm install node-red-contrib-splunk-hec

Synopsis

The purpose of this project is to allow node-red to publish a node-red payload to Splunk HEC endpoints.

First Published: 19/03/2026

Latest Version: 0.1.7 as at 12/06/2026 Special thanks to Gary Croker for the passthrough request

Latest update

Fixed a bug introduced in previous version. Messge passed to Splunk removed any custom attributes injected at msg. level, only raw payload was passed. Now passes complete msg including custom attributes added to the message by other flow nodes.

Please see CHANGELOG.md for latest release notes, additions, bug fixes etc...

Motivation

Original Node created and published by gdziuba

Originally node lacked ability to name nodes or the saved configurations. Our organisation uses this extensively and needed a way to distinguish between multiple saved configs. This code has been further developed into the new node module to include these missing features plus some...

Installation

The easiest way to install is through the Node-Red Palette Manager that can be found in the menu on the top right hand corner of the Node-Red ui.

Manual install with npm

npm install -g node-red-contrib-splunk-hec

Install from source

From github: Navigate to the your node_modules directory in your Node-RED instance. eg. cd ~/.node-red/node_modules

git clone https://github.com/IcyWorks/node-red-contrib-splunk-hec.git

cd splunk-hec
npm install

Example:

Import example flow:

splunk-hec_0.1.7_example.json

Setup

Splunk HTTP Event Collector Documentation Click this link with your mouse wheel to open in a new tab

Node-RED Functions for converting msg to correct structure for Metric Event Collector.

Single value MQTT payload message to Metric structure:

var o = msg.payload;
var v = msg.topic;
msg.payload = {};
msg.payload.fields = {};
msg.payload.fields._value = o;
msg.payload.fields.metric_name= v;
return msg;

Single value with dimensions enabled :

var o = msg.payload;
var v = msg.topic;
msg.payload = {};
msg.payload.splunkdims = true;
msg.payload.fields = {};
msg.payload.fields._value = o;
msg.payload.fields.metric_name= v;
msg.payload.fields.dimension1= "value1";
return msg;