Enable Deployment and HEC tokens in Global settings

SecurityFeller — Fri, 17 May 2024 16:31:32 GMT

We are generating HEC tokens on a deployment server and pushing them out to the HECs.

HEC tokens are disabled by default on the HECs and the deployment server and need to be enabled in global settings.

What I've done so far is:

-authorize.conf, this is for user tokens and isn't working for HEC tokens

-the CLI command for token enable isn't working because it's not enabled globally

-inputs.conf has [http] disabled=0

The only thing that has worked is enabling it via the UI. Is there a way to enable these over CLI?

Re: Enable Deployment and HEC tokens in Global settings

SecurityFeller — Fri, 17 May 2024 19:59:34 GMT

Solved. Splunk did not take conf file enablement on creation. It must be modified afterwards.