Add endpoint_target field to Splunk HEC destination

.generator/schemas/v2/openapi.yaml

@@ -75613,12 +75613,15 @@ components:
           description: |-
             If `true`, Splunk tries to extract timestamps from incoming log events.
             If `false`, Splunk assigns the time the event was received.
+            Only applies when `endpoint_target` is `event`; cannot be `true` when `endpoint_target` is `raw`.
           example: true
           type: boolean
         buffer:
           $ref: "#/components/schemas/ObservabilityPipelineBufferOptions"
         encoding:
           $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationEncoding"
+        endpoint_target:
+          $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationEndpointTarget"
         endpoint_url_key:
           description: Name of the environment variable or secret that holds the Splunk HEC endpoint URL.
           example: SPLUNK_HEC_ENDPOINT_URL
@@ -75673,6 +75676,16 @@ components:
       x-enum-varnames:
         - JSON
         - RAW_MESSAGE
+    ObservabilityPipelineSplunkHecDestinationEndpointTarget:
+      description: The Splunk HEC endpoint to send events to. Use `event` to send structured events to the `/event` endpoint, or `raw` to send the raw message to the `/raw` endpoint.
+      enum:
+        - event
+        - raw
+      example: event
+      type: string
+      x-enum-varnames:
+        - EVENT
+        - RAW
     ObservabilityPipelineSplunkHecDestinationTokenStrategy:
       description: Controls how the Splunk HEC token is supplied. Use `custom` to provide a token with `token_key`, or `from_source` to forward the token received from an upstream Splunk HEC source.
       enum:

cassettes/features/v2/observability_pipelines/Validate-an-observability-pipeline-with-Splunk-HEC-destination-endpoint-target-returns-OK-response.frozen

@@ -0,0 +1 @@
+2026-08-03T12:48:21.947Z

examples/v2/observability-pipelines/ValidatePipeline_1874470273.rb

@@ -0,0 +1,51 @@
+# Validate an observability pipeline with Splunk HEC destination endpoint_target returns "OK" response
+
+require "datadog_api_client"
+api_instance = DatadogAPIClient::V2::ObservabilityPipelinesAPI.new
+
+body = DatadogAPIClient::V2::ObservabilityPipelineSpec.new({
+  data: DatadogAPIClient::V2::ObservabilityPipelineSpecData.new({
+    attributes: DatadogAPIClient::V2::ObservabilityPipelineDataAttributes.new({
+      config: DatadogAPIClient::V2::ObservabilityPipelineConfig.new({
+        destinations: [
+          DatadogAPIClient::V2::ObservabilityPipelineSplunkHecDestination.new({
+            id: "splunk-hec-destination",
+            inputs: [
+              "my-processor-group",
+            ],
+            type: DatadogAPIClient::V2::ObservabilityPipelineSplunkHecDestinationType::SPLUNK_HEC,
+            token_key: "SPLUNK_HEC_TOKEN",
+            endpoint_target: DatadogAPIClient::V2::ObservabilityPipelineSplunkHecDestinationEndpointTarget::RAW,
+          }),
+        ],
+        processor_groups: [
+          DatadogAPIClient::V2::ObservabilityPipelineConfigProcessorGroup.new({
+            enabled: true,
+            id: "my-processor-group",
+            include: "service:my-service",
+            inputs: [
+              "datadog-agent-source",
+            ],
+            processors: [
+              DatadogAPIClient::V2::ObservabilityPipelineFilterProcessor.new({
+                enabled: true,
+                id: "filter-processor",
+                include: "status:error",
+                type: DatadogAPIClient::V2::ObservabilityPipelineFilterProcessorType::FILTER,
+              }),
+            ],
+          }),
+        ],
+        sources: [
+          DatadogAPIClient::V2::ObservabilityPipelineDatadogAgentSource.new({
+            id: "datadog-agent-source",
+            type: DatadogAPIClient::V2::ObservabilityPipelineDatadogAgentSourceType::DATADOG_AGENT,
+          }),
+        ],
+      }),
+      name: "Pipeline with Splunk HEC endpoint_target",
+    }),
+    type: "pipelines",
+  }),
+})
+p api_instance.validate_pipeline(body)

features/v2/observability_pipelines.feature

@@ -239,6 +239,14 @@ Feature: Observability Pipelines
     Then the response status is 200 OK
     And the response "errors" has length 0
 
+  @team:DataDog/observability-pipelines
+  Scenario: Validate an observability pipeline with Splunk HEC destination endpoint_target returns "OK" response
+    Given new "ValidatePipeline" request
+    And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "splunk-hec-destination", "inputs": ["my-processor-group"], "type": "splunk_hec", "token_key": "SPLUNK_HEC_TOKEN", "endpoint_target": "raw"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}]}], "sources": [{"id": "datadog-agent-source", "type": "datadog_agent"}]}, "name": "Pipeline with Splunk HEC endpoint_target"}, "type": "pipelines"}}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "errors" has length 0
+
   @team:DataDog/observability-pipelines
   Scenario: Validate an observability pipeline with Splunk HEC destination token_strategy returns "OK" response
     Given new "ValidatePipeline" request

lib/datadog_api_client/inflector.rb

@@ -5649,6 +5649,7 @@ def overrides
           "v2.observability_pipeline_split_array_processor_type" => "ObservabilityPipelineSplitArrayProcessorType",
           "v2.observability_pipeline_splunk_hec_destination" => "ObservabilityPipelineSplunkHecDestination",
           "v2.observability_pipeline_splunk_hec_destination_encoding" => "ObservabilityPipelineSplunkHecDestinationEncoding",
+          "v2.observability_pipeline_splunk_hec_destination_endpoint_target" => "ObservabilityPipelineSplunkHecDestinationEndpointTarget",
           "v2.observability_pipeline_splunk_hec_destination_token_strategy" => "ObservabilityPipelineSplunkHecDestinationTokenStrategy",
           "v2.observability_pipeline_splunk_hec_destination_type" => "ObservabilityPipelineSplunkHecDestinationType",
           "v2.observability_pipeline_splunk_hec_metrics_destination" => "ObservabilityPipelineSplunkHecMetricsDestination",

lib/datadog_api_client/v2/models/observability_pipeline_splunk_hec_destination.rb

@@ -25,6 +25,7 @@ class ObservabilityPipelineSplunkHecDestination
 
     # If `true`, Splunk tries to extract timestamps from incoming log events.
     # If `false`, Splunk assigns the time the event was received.
+    # Only applies when `endpoint_target` is `event`; cannot be `true` when `endpoint_target` is `raw`.
     attr_accessor :auto_extract_timestamp
 
     # Configuration for buffer settings on destination components.
@@ -33,6 +34,9 @@ class ObservabilityPipelineSplunkHecDestination
     # Encoding format for log events.
     attr_accessor :encoding
 
+    # The Splunk HEC endpoint to send events to. Use `event` to send structured events to the `/event` endpoint, or `raw` to send the raw message to the `/raw` endpoint.
+    attr_accessor :endpoint_target
+
     # Name of the environment variable or secret that holds the Splunk HEC endpoint URL.
     attr_accessor :endpoint_url_key
 
@@ -69,6 +73,7 @@ def self.attribute_map
         :'auto_extract_timestamp' => :'auto_extract_timestamp',
         :'buffer' => :'buffer',
         :'encoding' => :'encoding',
+        :'endpoint_target' => :'endpoint_target',
         :'endpoint_url_key' => :'endpoint_url_key',
         :'id' => :'id',
         :'index' => :'index',
@@ -88,6 +93,7 @@ def self.openapi_types
         :'auto_extract_timestamp' => :'Boolean',
         :'buffer' => :'ObservabilityPipelineBufferOptions',
         :'encoding' => :'ObservabilityPipelineSplunkHecDestinationEncoding',
+        :'endpoint_target' => :'ObservabilityPipelineSplunkHecDestinationEndpointTarget',
         :'endpoint_url_key' => :'String',
         :'id' => :'String',
         :'index' => :'String',
@@ -130,6 +136,10 @@ def initialize(attributes = {})
         self.encoding = attributes[:'encoding']
       end
 
+      if attributes.key?(:'endpoint_target')
+        self.endpoint_target = attributes[:'endpoint_target']
+      end
+
       if attributes.key?(:'endpoint_url_key')
         self.endpoint_url_key = attributes[:'endpoint_url_key']
       end
@@ -240,6 +250,7 @@ def ==(o)
           auto_extract_timestamp == o.auto_extract_timestamp &&
           buffer == o.buffer &&
           encoding == o.encoding &&
+          endpoint_target == o.endpoint_target &&
           endpoint_url_key == o.endpoint_url_key &&
           id == o.id &&
           index == o.index &&
@@ -256,7 +267,7 @@ def ==(o)
     # @return [Integer] Hash code
     # @!visibility private
     def hash
-      [auto_extract_timestamp, buffer, encoding, endpoint_url_key, id, index, indexed_fields, inputs, sourcetype, token_key, token_strategy, type, additional_properties].hash
+      [auto_extract_timestamp, buffer, encoding, endpoint_target, endpoint_url_key, id, index, indexed_fields, inputs, sourcetype, token_key, token_strategy, type, additional_properties].hash
     end
   end
 end

lib/datadog_api_client/v2/models/observability_pipeline_splunk_hec_destination_endpoint_target.rb

@@ -0,0 +1,27 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # The Splunk HEC endpoint to send events to. Use `event` to send structured events to the `/event` endpoint, or `raw` to send the raw message to the `/raw` endpoint.
+  class ObservabilityPipelineSplunkHecDestinationEndpointTarget
+    include BaseEnumModel
+
+    EVENT = "event".freeze
+    RAW = "raw".freeze
+  end
+end