diff --git a/plugins/out_splunk/splunk.c b/plugins/out_splunk/splunk.c
index d7493f9d24f..6c25b5b4ac6 100644
--- a/plugins/out_splunk/splunk.c
+++ b/plugins/out_splunk/splunk.c
@@ -353,9 +353,9 @@ static flb_sds_t extract_hec_token(struct flb_splunk *ctx, msgpack_object map,
     flb_sds_t hec_token;
 
     /* Extract HEC token (map which is from metadata lookup) */
-    if (ctx->event_sourcetype_key) {
-        hec_token = flb_ra_translate(ctx->ra_metadata_auth_key, tag, tag_len,
-                                     map, NULL);
+    if (ctx->metadata_auth_key) {
+        hec_token = flb_ra_translate_check(ctx->ra_metadata_auth_key, tag, tag_len,
+                                     map, NULL, FLB_TRUE);
         if (hec_token) {
             return hec_token;
         }
diff --git a/plugins/out_splunk/splunk_conf.c b/plugins/out_splunk/splunk_conf.c
index 06902ef227f..2cc78280883 100644
--- a/plugins/out_splunk/splunk_conf.c
+++ b/plugins/out_splunk/splunk_conf.c
@@ -263,7 +263,7 @@ struct flb_splunk *flb_splunk_conf_create(struct flb_output_instance *ins,
     }
 
     /* Currently, Splunk HEC token is stored in a fixed key, hec_token. */
-    ctx->metadata_auth_key = "hec_token";
+    ctx->metadata_auth_key = "$hec_token";
     if (ctx->metadata_auth_key) {
         ctx->ra_metadata_auth_key = flb_ra_create(ctx->metadata_auth_key, FLB_TRUE);
         if (!ctx->ra_metadata_auth_key) {