docs: in_splunk: fix config params, add missing options, sort table

[eschabell]

• Fix port default: 9880 -> 8088 (matches source code)
• Add missing http2 parameter (default: true)
• Add missing success_header parameter
• Remove non-existent successful_response_code parameter
• Sort configuration table alphabetically
• Fix "To start performing the checks" wording
• Add authentication example with splunk_token
• Add custom success headers example
• Fix classic config examples to use capitalized keys

Fixes #2346

Summary by CodeRabbit

• Documentation
  • Expanded Splunk input docs with HTTP/2 support and guidance
  • Updated default port to 8088 and standardized example naming/casing
  • Clarified buffer parameter wording and max-buffer behavior per JSON message
  • Added authentication guidance (HEC tokens, token-key handling, storing token metadata)
  • Introduced success-header usage examples and multi-format templates (YAML/conf)
  • Refined "Get started" wording and reorganized examples

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated Splunk input plugin documentation: added http2 (default true) and success_header, changed default port to 8088, reordered and clarified buffer parameters and token handling, and added YAML and conf examples plus authentication guidance. (50 words)

Changes

Cohort / File(s)	Change Summary
Splunk Input Plugin Documentation pipeline/inputs/splunk.md	Added http2 (default: true) and success_header; changed default port from 9880 to 8088; reordered and clarified buffer fields (buffer_chunk_size, buffer_max_size); clarified splunk_token, splunk_token_key, and store_token_in_metadata; expanded examples (YAML and .conf) and added authentication and custom-header guidance.

Sequence Diagram(s)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Suggested reviewers

• cosmo0920
• patrick-stephens

Poem

🐰 I hopped through docs with ears so keen,
Added http2 where it’s seen,
Port eight-zero-eight-eight takes the lead,
Tokens, headers — all in seed,
A tiny hop to make Splunk sing. 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately describes the main changes: fixing configuration parameters, adding missing options (http2, success_header), and sorting the documentation table.
Linked Issues check	✅ Passed	All objectives from issue #2346 are met: http2 parameter added, port corrected to 8088, success_header parameter added, config descriptions updated, and documentation expanded with examples.
Out of Scope Changes check	✅ Passed	All changes are directly related to updating the Splunk input plugin documentation as specified in issue #2346; no unrelated modifications detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@pipeline/inputs/splunk.md`:
- Line 83: Change the heading "### Authentication with HEC tokens" to
sentence-style capitalization: make only the first word capitalized and keep the
acronym HEC uppercased, e.g. "### Authentication with HEC tokens" (ensure any
previous Title Case like "Authentication With HEC Tokens" is replaced); update
the heading text in the markdown file where that heading appears.