[DOCS-14692] Add Splunk HEC metrics destination doc

config/_default/menus/main.en.yaml

@@ -6844,7 +6844,7 @@ menu:
       identifier: observability_pipelines_socket
       weight: 421
     - name: Splunk HEC
-      url: observability_pipelines/destinations/splunk_hec
+      url: observability_pipelines/destinations/splunk_hec/logs/
       parent: observability_pipelines_destinations
       identifier: observability_pipelines_splunk_hec
       weight: 422

content/en/observability_pipelines/destinations/_index.md

@@ -62,7 +62,7 @@ These are the available destinations:
 [16]: /observability_pipelines/destinations/opensearch/
 [17]: /observability_pipelines/destinations/sentinelone/
 [18]: /observability_pipelines/destinations/socket/
-[19]: /observability_pipelines/destinations/splunk_hec/
+[19]: /observability_pipelines/destinations/splunk_hec/logs/
 [20]: /observability_pipelines/destinations/sumo_logic_hosted_collector/
 [21]: /observability_pipelines/destinations/syslog/
 [22]: /observability_pipelines/destinations/amazon_s3/

content/en/observability_pipelines/destinations/splunk_hec/_index.md

@@ -0,0 +1,5 @@
+---
+title: Splunk HEC
+type: multi-code-lang
+external_redirect: /observability_pipelines/destinations/splunk_hec/logs/
+---

content/en/observability_pipelines/destinations/splunk_hec.md → content/en/observability_pipelines/destinations/splunk_hec/logs.md

@@ -1,14 +1,14 @@
 ---
 title: Splunk HTTP Event Collector (HEC) Destination
+description: Learn how to set up the Splunk HEC destination for logs in Observability Pipelines.
 disable_toc: false
-products:
-- name: Logs
-  icon: logs
-  url: /observability_pipelines/configuration/?tab=logs#pipeline-types
+aliases:
+- /observability_pipelines/destinations/splunk_hec/
+code_lang: logs
+type: multi-code-lang
+weight: 1
 ---
 
-{{< product-availability >}}
-
 ## Overview
 
 Use Observability Pipelines' Splunk HTTP Event Collector (HEC) destination to send logs to Splunk HEC.
@@ -63,13 +63,7 @@ Select the **Encoding** in the dropdown menu (**JSON** or **Raw**).
 {{< tabs >}}
 {{% tab "Secrets Management" %}}
 
-- Splunk HEC token identifier:
-	- References the Splunk HEC token for the Splunk indexer.
-	- The default identifier is `DESTINATION_SPLUNK_HEC_TOKEN`.
-- Splunk HEC endpoint URL identifier:
-	- References the Splunk HTTP Event Collector endpoint your Observability Pipelines Worker sends processed logs to. For example, `https://hec.splunkcloud.com:8088`.
-	- **Note**: `/services/collector/event` path is automatically appended to the endpoint.
-	- The default identifier is `DESTINATION_SPLUNK_HEC_ENDPOINT_URL`.
+{{% observability_pipelines/splunk_hec_secrets %}}
 
 {{% /tab %}}
 

content/en/observability_pipelines/destinations/splunk_hec/metrics.md

@@ -0,0 +1,90 @@
+---
+title: Splunk HTTP Event Collector (HEC) Destination
+description: Learn how to set up the Splunk HEC destination for metrics in Observability Pipelines.
+disable_toc: false
+code_lang: metrics
+type: multi-code-lang
+weight: 2
+---
+
+## Overview
+
+Use Observability Pipelines' Splunk HTTP Event Collector (HEC) destination to send metrics to Splunk HEC.
+
+## Setup
+
+Configure the Splunk HEC destination when you [set up a pipeline][1]. You can set up a pipeline in the [UI][3], using the [API][4], or with [Terraform][5]. The steps in this section are configured in the UI.
+
+<div class="alert alert-danger">For Secrets Management: Only enter the identifiers for the Splunk HEC token, endpoint, and if applicable, the TLS key pass. Do <b>not</b> enter the actual values.</div>
+
+{{% observability_pipelines/secrets_env_var_note %}}
+
+After you select the Splunk HEC destination in the pipeline UI:
+
+1. Enter the identifier for your token. If you leave it blank, the [default](#secret-defaults) is used.
+1. Enter the identifier for your endpoint URL. If you leave it blank, the [default](#secret-defaults) is used.
+
+### Optional settings
+
+#### Default namespace
+
+Enter a default namespace.
+
+#### Compression
+
+If you want to compress your metrics with gzip, select **gzip** in the dropdown menu. The default compression is **None**.
+
+#### Splunk index
+
+Enter the name of the Splunk index you want your data in. This has to be an allowed index for your HEC. See [template syntax][6] if you want to route metrics to different indexes based on specific fields in your metrics.
+
+#### Source
+
+Enter a source field and value if you want them added to your metrics.
+
+#### Source type override
+
+Set the `sourcetype` to override Splunk's default value, which is `httpevent` for HEC data. See [template syntax][6] if you want to route metrics to different source types based on specific fields in your metrics.
+
+#### Buffering
+
+{{% observability_pipelines/destination_buffer %}}
+
+#### Enable TLS
+
+{{% observability_pipelines/tls_settings %}}
+
+## Secret defaults
+
+{{% observability_pipelines/set_secrets_intro %}}
+
+{{< tabs >}}
+{{% tab "Secrets Management" %}}
+
+{{% observability_pipelines/splunk_hec_secrets %}}
+
+{{% /tab %}}
+
+{{% tab "Environment Variables" %}}
+
+{{% observability_pipelines/configure_existing_pipelines/destination_env_vars/splunk_hec %}}
+
+{{% /tab %}}
+{{< /tabs >}}
+
+### How the destination works
+
+#### Event batching
+
+A batch of events is flushed when one of these parameters is met. See [event batching][2] for more information.
+
+| Maximum Events | Maximum Size (MB) | Timeout (seconds)   |
+|----------------|-------------------|---------------------|
+|    TKTK        |     TKTK          |          TKTK       |
+
+[1]: /observability_pipelines/configuration/set_up_pipelines/
+[2]: /observability_pipelines/destinations/#event-batching
+[3]: https://app.datadoghq.com/observability-pipelines
+[4]: /api/latest/observability-pipelines/
+[5]: https://registry.terraform.io/providers/datadog/datadog/latest/docs/resources/observability_pipeline
+[6]: /observability_pipelines/destinations/#template-syntax

layouts/shortcodes/observability_pipelines/configure_existing_pipelines/destination_env_vars/splunk_hec.en.md

@@ -2,6 +2,6 @@
     - The Splunk HEC token for the Splunk indexer. **Note**: Depending on your shell and environment, you may not want to wrap your environment variable in quotes.
     - The default environment variable is `DD_OP_DESTINATION_SPLUNK_HEC_TOKEN`.
 - Base URL of the Splunk instance:
-    - The Splunk HTTP Event Collector endpoint your Observability Pipelines Worker sends processed logs to. For example, `https://hec.splunkcloud.com:8088`.
+    - The Splunk HTTP Event Collector endpoint your Observability Pipelines Worker sends processed data to. For example, `https://hec.splunkcloud.com:8088`.
     **Note**: `/services/collector/event` path is automatically appended to the endpoint.
     - The default environment variable is `DD_OP_DESTINATION_SPLUNK_HEC_ENDPOINT_URL`.

layouts/shortcodes/observability_pipelines/splunk_hec_secrets.en.md

@@ -0,0 +1,7 @@
+- Splunk HEC token identifier:
+	- References the Splunk HEC token for the Splunk indexer.
+	- The default identifier is `DESTINATION_SPLUNK_HEC_TOKEN`.
+- Splunk HEC endpoint URL identifier:
+	- References the Splunk HTTP Event Collector endpoint your Observability Pipelines Worker sends processed data to. For example, `https://hec.splunkcloud.com:8088`.
+	- **Note**: `/services/collector/event` path is automatically appended to the endpoint.
+	- The default identifier is `DESTINATION_SPLUNK_HEC_ENDPOINT_URL`.