Skip to content

Add HECToken entity and HECTokens collection#822

Open
dannyota wants to merge 1 commit into
splunk:developfrom
dannyota:feature/hec-entity
Open

Add HECToken entity and HECTokens collection#822
dannyota wants to merge 1 commit into
splunk:developfrom
dannyota:feature/hec-entity

Conversation

@dannyota

Copy link
Copy Markdown

Description of PR

Adds an HECToken entity and HECTokens collection to splunklib.client, wrapping the data/inputs/http/ REST endpoint.

HTTP Event Collector is widely used for data ingestion, but the SDK has no entity class for managing HEC tokens — users must use raw REST calls. This PR follows the same Entity/Collection pattern used throughout client.py.

Changes:

  • HECToken(Entity) — with enable() and disable() convenience methods
  • HECTokens(Collection) — standard collection for CRUD operations on HEC tokens
  • Service.hec_tokens property to access the collection
  • PATH_HEC_TOKENS constant (data/inputs/http/)

Usage:

for token in service.hec_tokens:
    print(token.name, token.content.get("token"))

service.hec_tokens.create("my_token")
service.hec_tokens["http://my_token"].disable()

Note: Splunk prefixes HEC token names with http:// (e.g. creating my_token results in name http://my_token). This is standard Splunk behavior, not an SDK issue.

Testing the changes

Unit tests added in tests/unit/test_hec_token.py (3 tests):

  • Entity/Collection subclass checks
  • Path constant verification

Tested with Python 3.13, Splunk Enterprise 10.4.0. Passes ruff check, ruff format, and basedpyright.

Documentation

Docstrings follow existing SDK conventions. The enable()/disable() methods mirror the pattern used by other entities that support toggling (e.g. SavedSearch).

Dependencies and other resources

No external dependencies. Follows the same Entity/Collection pattern as SavedSearch, Index, and others in client.py.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant