diff --git a/pipeline/inputs/splunk.md b/pipeline/inputs/splunk.md index 6ecafc16e..38a7fcd75 100644 --- a/pipeline/inputs/splunk.md +++ b/pipeline/inputs/splunk.md @@ -12,7 +12,9 @@ The **splunk** input plugin handles [Splunk HTTP HEC](https://docs.splunk.com/Do | buffer_max_size | Specify the maximum buffer size in KB to receive a JSON message. | 4M | | buffer_chunk_size | This sets the chunk size for incoming incoming JSON messages. These chunks are then stored/managed in the space available by buffer_max_size. | 512K | | successful_response_code | It allows to set successful response code. `200`, `201` and `204` are supported. | 201 | -| splunk\_token | Add an Splunk token for HTTP HEC.` | | +| splunk\_token | Specify a Splunk token for HTTP HEC authentication. If multiple tokens are specified (with commas and no spaces), usage will be divided across each of the tokens. | | +| store\_token\_in\_metadata | Store Splunk HEC tokens in the Fluent Bit metadata. If set false, they will be stored as normal key-value pairs in the record data. | true | +| splunk\_token\_key | Use the specified key for storing the Splunk token for HTTP HEC. This is only effective when `store_token_in_metadata` is false. | @splunk_token | | Threaded | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` | ## Getting Started