Is there a way to export audit logs to splunk via HEC?

[jelkhouri-splunk]

I see in the docs that you can capture audit logs via a UF or via fluentd. Curious if there is a way to forward logs to Splunk Cloud via HEC?

[webvictim]

The only Teleport-supported method of exporting audit logs at the moment is to use the event-handler plugin, which reads and outputs audit logs and session recordings in a Fluentd-compatible format to be sent whenever they're needed.

I presume HEC means HTTP Event Collector? I believe we do have a number of users who are using a universal forwarder to send logs on from Fluentd to Splunk-hosted HTTP event collectors.