The answer to your question is C. services/data/collector. This is the endpoint URI used to collect
data in a customer managed Splunk Enterprise environment. According to the Splunk
documentation1, “The HTTP Event Collector REST API endpoint is /services/data/collector. You can
use this endpoint to send events to HTTP Event Collector on a Splunk Enterprise or Splunk Cloud
Platform deployment.” You can also use this endpoint to send events to a specific token or index1.
For example, you can use the following curl command to send an event with the token 578254cc-
05f5-46b5-957b-910d1400341a and the index main:
curl -k https://localhost:8088/services/data/collector -H 'Authorization: Splunk 578254cc-05f5-46b5-
957b-910d1400341a' -d '{"index":"main","event":"Hello, world!"}'
