Send the same HEC event separately to Machine Data Lake and to a Splunk index when both destinations must receive the event.
-
You have a HEC token whose default or allowed destination is the Machine Data Lake raw table, such as ~.federated.<raw_table_name>.
-
You have a separate HEC token whose default or allowed destination is the preserved Splunk index.
-
The HEC client can make two requests for the same event and can handle each response and retry independently.
Use this procedure when a HEC client must send the same event to Machine Data Lake and to a Splunk index. The HEC client sends two separate requests, one for each destination.
- Prepare one event payload with a unique test value.
Use the same mdl_test_id, sourcetype, source, and host values for both requests.
- Send the event with the Machine Data Lake HEC token.
curl "https://http-inputs-<stack>.splunkcloud.com/services/collector/event" -H "Authorization: Splunk <mdl-token>" -H "Content-Type: application/json" -d '{"event":"mdl_test_id=<unique_id> action=dual_hec_test","sourcetype":"cisco:asa","source":"hec:firewall","host":"asa-01"}'
- Send the same event with the Splunk index HEC token.
curl "https://http-inputs-<stack>.splunkcloud.com/services/collector/event" -H "Authorization: Splunk <index-token>" -H "Content-Type: application/json" -d '{"event":"mdl_test_id=<unique_id> action=dual_hec_test","sourcetype":"cisco:asa","source":"hec:firewall","host":"asa-01"}'
If the index token allows explicit index selection, the payload can include "index":"<preserved_index>". If the token default identifies the preserved index, the payload can omit index.
- Handle each HEC response and retry independently.
Treat the Machine Data Lake request and the Splunk index request separately. If one request succeeds and the other fails, retry only the failed request according to the HEC client's retry handling.
- Validate the unique event in both destinations.
Search the raw table and the preserved Splunk index for the same unique test value.
mdl_test_id="<unique_id>" sourcetype="cisco:asa" source="hec:firewall" host="asa-01"
index=<preserved_index> mdl_test_id="<unique_id>" sourcetype="cisco:asa" source="hec:firewall" host="asa-01" earliest=-30m latest=now
The same event is accepted through two independent HEC requests. One request lands in the Machine Data Lake raw table, and the other request lands in the preserved Splunk index.