splunk-hec-handler

What it is and what it does

This package provides a Python logging handler that sends log records to Splunk via its HTTP Event Collector (HEC) API. It wraps the standard Python logging framework to route messages directly into Splunk as JSON events, allowing you to centralize application logs in Splunk without separate log file collection. The handler automatically timestamps events, preserves dictionary objects as structured JSON, and supports custom fields and metadata overrides through a 'fields' key in log records.

The handler depends only on requests for HTTP communication and is designed to work across Linux, macOS, and Windows. It supports both HTTP and HTTPS connections, with optional SSL verification control for self-signed certificates. String log messages are converted to JSON with 'log_level' and 'message' keys, while dictionary objects are logged as-is, making it flexible for both simple text logging and structured event logging.

Use it for:

• Centralize application logs from Python services into Splunk for monitoring and analysis.
• Send structured event data (dicts with custom fields) to Splunk indexes for security or operational intelligence.
• Route logs to multiple Splunk indexes by configuring different handlers with different tokens or index settings.
• Add custom metadata fields (host, source, sourcetype) to log events at the application level.
• Integrate Python application logging with existing Splunk infrastructure without external log collectors.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Integrates Python logging with Splunk's HTTP Event Collector (HEC) to send log messages directly to Splunk as JSON events.

Yes, if you are already committed to Splunk and need straightforward Python logging integration. The package is simple, has low install friction, and carries a permissive license. However, the abandoned maintenance status (last update 2023-02-16) means you should verify compatibility with your Splunk version and Python runtime before production deployment, and be prepared to maintain a fork if critical issues arise.

Install

splunk-hec-handler on PyPI

pip install splunk-hec-handler

uv add splunk-hec-handler

poetry add splunk-hec-handler

Installing splunk-hec-handler

Before you install

Low install friction with a single runtime dependency (requests). However, the package is abandoned—last commit was 2023-02-16 and no updates have been released since. Maintenance status should be a consideration for production use.

License in practice

MIT License (permissive) means you can use, modify, and distribute this package freely in commercial or private projects with minimal restrictions.

Quickstart

pip install splunk-hec-handler

import logging
from splunk_hec_handler import SplunkHecHandler

logger = logging.getLogger('example')
logger.setLevel(logging.DEBUG)
splunk_handler = SplunkHecHandler('splunkfw.domain.tld',
                    'EA33046C-6FEC-4DC0-AC66-4326E58B54C3',
                    port=8888, proto='https', ssl_verify=True)
logger.addHandler(splunk_handler)
logger.info("Test message")

Requires a running Splunk instance with HTTP Event Collector enabled and a valid HEC token.

Verify before relying

• Whether the package works reliably with modern Python versions (3.9+) despite classifiers only listing up to 3.8.
• Current compatibility with recent versions of the requests dependency.
• Whether abandoned status impacts security or compatibility with current Splunk versions.

Package facts

Evidence: splunk_hec_handler-1.2.0-py2.py3-none-any.whl

Tags

More Logging packages