Add endpoint_target field to Splunk HEC destination

.generator/schemas/v2/openapi.yaml

@@ -75613,12 +75613,15 @@ components:
           description: |-
             If `true`, Splunk tries to extract timestamps from incoming log events.
             If `false`, Splunk assigns the time the event was received.
+            Only applies when `endpoint_target` is `event`; cannot be `true` when `endpoint_target` is `raw`.
           example: true
           type: boolean
         buffer:
           $ref: "#/components/schemas/ObservabilityPipelineBufferOptions"
         encoding:
           $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationEncoding"
+        endpoint_target:
+          $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationEndpointTarget"
         endpoint_url_key:
           description: Name of the environment variable or secret that holds the Splunk HEC endpoint URL.
           example: SPLUNK_HEC_ENDPOINT_URL
@@ -75673,6 +75676,16 @@ components:
       x-enum-varnames:
         - JSON
         - RAW_MESSAGE
+    ObservabilityPipelineSplunkHecDestinationEndpointTarget:
+      description: The Splunk HEC endpoint to send events to. Use `event` to send structured events to the `/event` endpoint, or `raw` to send the raw message to the `/raw` endpoint.
+      enum:
+        - event
+        - raw
+      example: event
+      type: string
+      x-enum-varnames:
+        - EVENT
+        - RAW
     ObservabilityPipelineSplunkHecDestinationTokenStrategy:
       description: Controls how the Splunk HEC token is supplied. Use `custom` to provide a token with `token_key`, or `from_source` to forward the token received from an upstream Splunk HEC source.
       enum:

docs/datadog_api_client.v2.model.rst

@@ -31532,6 +31532,13 @@ datadog\_api\_client.v2.model.observability\_pipeline\_splunk\_hec\_destination\
    :members:
    :show-inheritance:
 
+datadog\_api\_client.v2.model.observability\_pipeline\_splunk\_hec\_destination\_endpoint\_target module
+--------------------------------------------------------------------------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_endpoint_target
+   :members:
+   :show-inheritance:
+
 datadog\_api\_client.v2.model.observability\_pipeline\_splunk\_hec\_destination\_token\_strategy module
 -------------------------------------------------------------------------------------------------------
 

examples/v2/observability-pipelines/ValidatePipeline_1874470273.py

@@ -0,0 +1,85 @@
+"""
+Validate an observability pipeline with Splunk HEC destination endpoint_target returns "OK" response
+"""
+
+from datadog_api_client import ApiClient, Configuration
+from datadog_api_client.v2.api.observability_pipelines_api import ObservabilityPipelinesApi
+from datadog_api_client.v2.model.observability_pipeline_config import ObservabilityPipelineConfig
+from datadog_api_client.v2.model.observability_pipeline_config_processor_group import (
+    ObservabilityPipelineConfigProcessorGroup,
+)
+from datadog_api_client.v2.model.observability_pipeline_data_attributes import ObservabilityPipelineDataAttributes
+from datadog_api_client.v2.model.observability_pipeline_datadog_agent_source import (
+    ObservabilityPipelineDatadogAgentSource,
+)
+from datadog_api_client.v2.model.observability_pipeline_datadog_agent_source_type import (
+    ObservabilityPipelineDatadogAgentSourceType,
+)
+from datadog_api_client.v2.model.observability_pipeline_filter_processor import ObservabilityPipelineFilterProcessor
+from datadog_api_client.v2.model.observability_pipeline_filter_processor_type import (
+    ObservabilityPipelineFilterProcessorType,
+)
+from datadog_api_client.v2.model.observability_pipeline_spec import ObservabilityPipelineSpec
+from datadog_api_client.v2.model.observability_pipeline_spec_data import ObservabilityPipelineSpecData
+from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination import (
+    ObservabilityPipelineSplunkHecDestination,
+)
+from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_endpoint_target import (
+    ObservabilityPipelineSplunkHecDestinationEndpointTarget,
+)
+from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_type import (
+    ObservabilityPipelineSplunkHecDestinationType,
+)
+
+body = ObservabilityPipelineSpec(
+    data=ObservabilityPipelineSpecData(
+        attributes=ObservabilityPipelineDataAttributes(
+            config=ObservabilityPipelineConfig(
+                destinations=[
+                    ObservabilityPipelineSplunkHecDestination(
+                        id="splunk-hec-destination",
+                        inputs=[
+                            "my-processor-group",
+                        ],
+                        type=ObservabilityPipelineSplunkHecDestinationType.SPLUNK_HEC,
+                        token_key="SPLUNK_HEC_TOKEN",
+                        endpoint_target=ObservabilityPipelineSplunkHecDestinationEndpointTarget.RAW,
+                    ),
+                ],
+                processor_groups=[
+                    ObservabilityPipelineConfigProcessorGroup(
+                        enabled=True,
+                        id="my-processor-group",
+                        include="service:my-service",
+                        inputs=[
+                            "datadog-agent-source",
+                        ],
+                        processors=[
+                            ObservabilityPipelineFilterProcessor(
+                                enabled=True,
+                                id="filter-processor",
+                                include="status:error",
+                                type=ObservabilityPipelineFilterProcessorType.FILTER,
+                            ),
+                        ],
+                    ),
+                ],
+                sources=[
+                    ObservabilityPipelineDatadogAgentSource(
+                        id="datadog-agent-source",
+                        type=ObservabilityPipelineDatadogAgentSourceType.DATADOG_AGENT,
+                    ),
+                ],
+            ),
+            name="Pipeline with Splunk HEC endpoint_target",
+        ),
+        type="pipelines",
+    ),
+)
+
+configuration = Configuration()
+with ApiClient(configuration) as api_client:
+    api_instance = ObservabilityPipelinesApi(api_client)
+    response = api_instance.validate_pipeline(body=body)
+
+    print(response)

src/datadog_api_client/v2/model/observability_pipeline_config_destination_item.py

@@ -223,8 +223,12 @@ def __init__(self, **kwargs):
 
         :param auto_extract_timestamp: If `true`, Splunk tries to extract timestamps from incoming log events.
             If `false`, Splunk assigns the time the event was received.
+            Only applies when `endpoint_target` is `event`; cannot be `true` when `endpoint_target` is `raw`.
         :type auto_extract_timestamp: bool, optional
 
+        :param endpoint_target: The Splunk HEC endpoint to send events to. Use `event` to send structured events to the `/event` endpoint, or `raw` to send the raw message to the `/raw` endpoint.
+        :type endpoint_target: ObservabilityPipelineSplunkHecDestinationEndpointTarget, optional
+
         :param index: Optional name of the Splunk index where logs are written.
         :type index: str, optional
 

src/datadog_api_client/v2/model/observability_pipeline_splunk_hec_destination.py

@@ -18,6 +18,9 @@
     from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_encoding import (
         ObservabilityPipelineSplunkHecDestinationEncoding,
     )
+    from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_endpoint_target import (
+        ObservabilityPipelineSplunkHecDestinationEndpointTarget,
+    )
     from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_token_strategy import (
         ObservabilityPipelineSplunkHecDestinationTokenStrategy,
     )
@@ -42,6 +45,9 @@ def openapi_types(_):
         from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_encoding import (
             ObservabilityPipelineSplunkHecDestinationEncoding,
         )
+        from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_endpoint_target import (
+            ObservabilityPipelineSplunkHecDestinationEndpointTarget,
+        )
         from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_token_strategy import (
             ObservabilityPipelineSplunkHecDestinationTokenStrategy,
         )
@@ -53,6 +59,7 @@ def openapi_types(_):
             "auto_extract_timestamp": (bool,),
             "buffer": (ObservabilityPipelineBufferOptions,),
             "encoding": (ObservabilityPipelineSplunkHecDestinationEncoding,),
+            "endpoint_target": (ObservabilityPipelineSplunkHecDestinationEndpointTarget,),
             "endpoint_url_key": (str,),
             "id": (str,),
             "index": (str,),
@@ -68,6 +75,7 @@ def openapi_types(_):
         "auto_extract_timestamp": "auto_extract_timestamp",
         "buffer": "buffer",
         "encoding": "encoding",
+        "endpoint_target": "endpoint_target",
         "endpoint_url_key": "endpoint_url_key",
         "id": "id",
         "index": "index",
@@ -93,6 +101,7 @@ def __init__(
             UnsetType,
         ] = unset,
         encoding: Union[ObservabilityPipelineSplunkHecDestinationEncoding, UnsetType] = unset,
+        endpoint_target: Union[ObservabilityPipelineSplunkHecDestinationEndpointTarget, UnsetType] = unset,
         endpoint_url_key: Union[str, UnsetType] = unset,
         index: Union[str, UnsetType] = unset,
         indexed_fields: Union[List[str], UnsetType] = unset,
@@ -108,6 +117,7 @@ def __init__(
 
         :param auto_extract_timestamp: If ``true`` , Splunk tries to extract timestamps from incoming log events.
             If ``false`` , Splunk assigns the time the event was received.
+            Only applies when ``endpoint_target`` is ``event`` ; cannot be ``true`` when ``endpoint_target`` is ``raw``.
         :type auto_extract_timestamp: bool, optional
 
         :param buffer: Configuration for buffer settings on destination components.
@@ -116,6 +126,9 @@ def __init__(
         :param encoding: Encoding format for log events.
         :type encoding: ObservabilityPipelineSplunkHecDestinationEncoding, optional
 
+        :param endpoint_target: The Splunk HEC endpoint to send events to. Use ``event`` to send structured events to the ``/event`` endpoint, or ``raw`` to send the raw message to the ``/raw`` endpoint.
+        :type endpoint_target: ObservabilityPipelineSplunkHecDestinationEndpointTarget, optional
+
         :param endpoint_url_key: Name of the environment variable or secret that holds the Splunk HEC endpoint URL.
         :type endpoint_url_key: str, optional
 
@@ -149,6 +162,8 @@ def __init__(
             kwargs["buffer"] = buffer
         if encoding is not unset:
             kwargs["encoding"] = encoding
+        if endpoint_target is not unset:
+            kwargs["endpoint_target"] = endpoint_target
         if endpoint_url_key is not unset:
             kwargs["endpoint_url_key"] = endpoint_url_key
         if index is not unset:

src/datadog_api_client/v2/model/observability_pipeline_splunk_hec_destination_endpoint_target.py

@@ -0,0 +1,42 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+
+from datadog_api_client.model_utils import (
+    ModelSimple,
+    cached_property,
+)
+
+from typing import ClassVar
+
+
+class ObservabilityPipelineSplunkHecDestinationEndpointTarget(ModelSimple):
+    """
+    The Splunk HEC endpoint to send events to. Use `event` to send structured events to the `/event` endpoint, or `raw` to send the raw message to the `/raw` endpoint.
+
+    :param value: Must be one of ["event", "raw"].
+    :type value: str
+    """
+
+    allowed_values = {
+        "event",
+        "raw",
+    }
+    EVENT: ClassVar["ObservabilityPipelineSplunkHecDestinationEndpointTarget"]
+    RAW: ClassVar["ObservabilityPipelineSplunkHecDestinationEndpointTarget"]
+
+    @cached_property
+    def openapi_types(_):
+        return {
+            "value": (str,),
+        }
+
+
+ObservabilityPipelineSplunkHecDestinationEndpointTarget.EVENT = ObservabilityPipelineSplunkHecDestinationEndpointTarget(
+    "event"
+)
+ObservabilityPipelineSplunkHecDestinationEndpointTarget.RAW = ObservabilityPipelineSplunkHecDestinationEndpointTarget(
+    "raw"
+)

src/datadog_api_client/v2/models/__init__.py

@@ -6459,6 +6459,9 @@
 from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_encoding import (
     ObservabilityPipelineSplunkHecDestinationEncoding,
 )
+from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_endpoint_target import (
+    ObservabilityPipelineSplunkHecDestinationEndpointTarget,
+)
 from datadog_api_client.v2.model.observability_pipeline_splunk_hec_destination_token_strategy import (
     ObservabilityPipelineSplunkHecDestinationTokenStrategy,
 )
@@ -15105,6 +15108,7 @@
     "ObservabilityPipelineSplitArrayProcessorType",
     "ObservabilityPipelineSplunkHecDestination",
     "ObservabilityPipelineSplunkHecDestinationEncoding",
+    "ObservabilityPipelineSplunkHecDestinationEndpointTarget",
     "ObservabilityPipelineSplunkHecDestinationTokenStrategy",
     "ObservabilityPipelineSplunkHecDestinationType",
     "ObservabilityPipelineSplunkHecMetricsDestination",

tests/v2/cassettes/test_scenarios/test_validate_an_observability_pipeline_with_splunk_hec_destination_endpoint_target_returns_ok_response.frozen

@@ -0,0 +1 @@
+2026-08-03T12:48:21.947Z

tests/v2/cassettes/test_scenarios/test_validate_an_observability_pipeline_with_splunk_hec_destination_endpoint_target_returns_ok_response.yaml

@@ -0,0 +1,23 @@
+interactions:
+- request:
+    body: '{"data":{"attributes":{"config":{"destinations":[{"endpoint_target":"raw","id":"splunk-hec-destination","inputs":["my-processor-group"],"token_key":"SPLUNK_HEC_TOKEN","type":"splunk_hec"}],"processor_groups":[{"enabled":true,"id":"my-processor-group","include":"service:my-service","inputs":["datadog-agent-source"],"processors":[{"enabled":true,"id":"filter-processor","include":"status:error","type":"filter"}]}],"sources":[{"id":"datadog-agent-source","type":"datadog_agent"}]},"name":"Pipeline
+      with Splunk HEC endpoint_target"},"type":"pipelines"}}'
+    headers:
+      accept:
+      - application/json
+      content-type:
+      - application/json
+    method: POST
+    uri: https://api.datadoghq.com/api/v2/obs-pipelines/pipelines/validate
+  response:
+    body:
+      string: '{"errors":[]}
+
+        '
+    headers:
+      content-type:
+      - application/vnd.api+json
+    status:
+      code: 200
+      message: OK
+version: 1

tests/v2/features/observability_pipelines.feature

@@ -239,6 +239,14 @@ Feature: Observability Pipelines
     Then the response status is 200 OK
     And the response "errors" has length 0
 
+  @team:DataDog/observability-pipelines
+  Scenario: Validate an observability pipeline with Splunk HEC destination endpoint_target returns "OK" response
+    Given new "ValidatePipeline" request
+    And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "splunk-hec-destination", "inputs": ["my-processor-group"], "type": "splunk_hec", "token_key": "SPLUNK_HEC_TOKEN", "endpoint_target": "raw"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}]}], "sources": [{"id": "datadog-agent-source", "type": "datadog_agent"}]}, "name": "Pipeline with Splunk HEC endpoint_target"}, "type": "pipelines"}}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "errors" has length 0
+
   @team:DataDog/observability-pipelines
   Scenario: Validate an observability pipeline with Splunk HEC destination token_strategy returns "OK" response
     Given new "ValidatePipeline" request