diff --git a/pipeline/inputs/splunk.md b/pipeline/inputs/splunk.md index 53252dd18..bc85adbad 100644 --- a/pipeline/inputs/splunk.md +++ b/pipeline/inputs/splunk.md @@ -12,9 +12,9 @@ The **splunk** input plugin handles [Splunk HTTP HEC](https://docs.splunk.com/Do | buffer_max_size | Specify the maximum buffer size in KB to receive a JSON message. | 4M | | buffer_chunk_size | This sets the chunk size for incoming incoming JSON messages. These chunks are then stored/managed in the space available by buffer_max_size. | 512K | | successful_response_code | It allows to set successful response code. `200`, `201` and `204` are supported. | 201 | -| splunk\_token | Add an Splunk token for HTTP HEC. If specified multiple tokens with commas, it will be divided into each of tokens and they will be used for authentication of HTTP HEC. | | -| store\_token\_to\_metadata | Store Splunk HEC tokens to matadata. If set as false, they will be stored into records. | true | -| splunk\_token\_key | Add a key for storing Splunk token for HTTP HEC. This is effective when `store_token_to_metadata` as false. | @splunk_token | +| splunk\_token | Specify a Splunk token for HTTP HEC authentication. If multiple tokens are specified (with commas and no spaces), usage will be divided across each of the tokens. | | +| store\_token\_in\_metadata | Store Splunk HEC tokens as a part of metadata. If set as false, they will be stored as a part of records. | true | +| splunk\_token\_key | Use the specified key for storing the Splunk token for HTTP HEC. This is effective when `store_token_in_metadata` as false. | @splunk_token | ## Getting Started