Skip to main content
A data export to Splunk sends one event per row to your Splunk HTTP Event Collector (HEC). Each event carries the row as JSON, plus fields that identify the export, the run, and the row. Data exports work with Splunk Cloud and Splunk Enterprise. For sources, schedules, and run behavior, see Data exports.

​
Prerequisites

  • Splunk Cloud or Splunk Enterprise with the HTTP Event Collector enabled.
  • An HEC token that can write to the index you want to use.
  • An HTTPS HEC endpoint that Lovable can reach over the public internet.
  • The workspace admin or owner role in Lovable, on an Enterprise plan.

​
Set up the export

Create the export in Lovable with your HTTP Event Collector endpoint and token.
1

Start a new export

Go to Data exports, click New data export, and choose Splunk HEC under Destination.
2

Enter the endpoint and token

Fill in the form:
  • Endpoint URL: your HTTPS HEC endpoint, for example https://prd-p-example.splunkcloud.com:8088/services/collector/event. You can also enter the URL without a path, or with /services/collector. Lovable always sends to /services/collector/event.
  • Token: your HEC token.
  • Index (optional), Source (optional), and Sourcetype (optional): values Lovable sets on every event. Leave them blank to use the defaults of your token.
3

Choose TLS verification

Under TLS verification, choose how Lovable checks your endpoint’s certificate:
4

Choose the source and test

Choose the Source and click Test connection. Lovable sends one test event to your HEC endpoint. See Test events.
5

Create the export

Click Create export.
To rotate the token, edit the export and enter the new token in Token. Leave the field blank to keep the current token. Lovable stores your token encrypted. Test connection stays disabled until Token is filled in, also when you edit a saved export. To test a saved export again, enter the token again. You can change the token, index, source, sourcetype, and TLS settings later. You cannot change the endpoint URL. To use another endpoint, create a new export.

​
Exported events

Each row becomes one HEC event. The event time is the row’s timestamp. The event body is the row, with the fields described in Sources. Lovable adds these fields to every event: Here is an audit log event as Lovable sends it, formatted for readability:
The event object holds every field of the source. This example shows only some of them.

​
Search and remove duplicates

Search by lovable_export_id, lovable_run_id, or lovable_workspace_id. Delivery is at least once, so a retried run can send an event again. Remove duplicates with dedup in searches and dashboards:

​
Test events

Test connection sends one event with the message lovable customer data export connection test and the field lovable_probe=true. To leave test events out of a search, add NOT lovable_probe=true.

​
Troubleshooting

Lovable could not verify your endpoint’s certificate. Check that the endpoint host matches the certificate. For a private certificate authority, choose Custom CA certificate and paste the signing certificate. For a self-signed certificate, choose Skip TLS verification.
Splunk rejected the token. Check the token, and that it can write to the index you set.
Check the Index and Sourcetype, and that the token can write to that index.
Lovable could not use your endpoint settings. This covers a wrong Endpoint URL, an endpoint that Lovable cannot reach over the public internet, and an invalid CA certificate. Check the Endpoint URL, your network settings, and the CA certificate (PEM) if you use one.
Splunk rejects events larger than the HEC max_content_length setting. Raise max_content_length on your Splunk deployment, then let the next run retry. Until the limit is raised, the export does not advance past that data. If you cannot change the limit, contact Lovable support.
See Troubleshooting for general run issues.