You can configure an Edge Processor to send data to Splunk Enterprise or Splunk Cloud Platform using HEC. See Send data from Edge Processors to non-connected Splunk platform deployments using HEC.

If the Edge Processor does not extract the event fields or timestamps that you want when ingesting HEC data, you can configure pipelines to extract that information. Additionally, if you are sending data from an Edge Processor to Splunk Enterprise or Splunk Cloud Platform, you can rely on the automatic extractions performed by the Splunk platform deployment or configure custom extractions in the Splunk platform deployment.

• For information about using an Edge Processor to extract fields and timestamps before sending your data to a destination, see Extract fields from event data using an Edge Processor and Extract timestamps from event data using an Edge Processor.
• For information about field and timestamp extractions in the Splunk platform, see the following documentation:
  • When Splunk software extracts fields in the Splunk Cloud Platform Knowledge Manager Manual.
  • The Configure timestamps chapter and the Configure indexed field extraction chapter in the Splunk Cloud Platform Getting Data In manual.