Description of PR

Adds an HECToken entity and HECTokens collection to splunklib.client, wrapping the data/inputs/http/ REST endpoint.

HTTP Event Collector is widely used for data ingestion, but the SDK has no entity class for managing HEC tokens — users must use raw REST calls. This PR follows the same Entity/Collection pattern used throughout client.py.

Changes:

• HECToken(Entity) — with enable() and disable() convenience methods
• HECTokens(Collection) — standard collection for CRUD operations on HEC tokens
• Service.hec_tokens property to access the collection
• PATH_HEC_TOKENS constant (data/inputs/http/)

Usage:

for token in service.hec_tokens:
    print(token.name, token.content.get("token"))

service.hec_tokens.create("my_token")
service.hec_tokens["http://my_token"].disable()

Note: Splunk prefixes HEC token names with http:// (e.g. creating my_token results in name http://my_token). This is standard Splunk behavior, not an SDK issue.

Testing the changes

Unit tests added in tests/unit/test_hec_token.py (3 tests):

• Entity/Collection subclass checks
• Path constant verification

Tested with Python 3.13, Splunk Enterprise 10.4.0. Passes ruff check, ruff format, and basedpyright.

Documentation

Docstrings follow existing SDK conventions. The enable()/disable() methods mirror the pattern used by other entities that support toggling (e.g. SavedSearch).

Dependencies and other resources

No external dependencies. Follows the same Entity/Collection pattern as SavedSearch, Index, and others in client.py.