topic Re: Help needed with HEC tokens in Getting Data In

Help needed with HEC tokens

Roy_9 — Thu, 18 Nov 2021 17:42:35 GMT

Hello,

I have an index and 3 custom sourcetypes built in place, Suppose if the source wants to stream logs into Splunk, do i need to create 3 HEC tokens? I can see when i am trying to create HEC inputs, it is asking me to select sourcetype where i can only select one sourcetype.

Please help me with this situation.

Thanks

Re: Help needed with HEC tokens

PickleRick — Thu, 18 Nov 2021 19:38:11 GMT

It depends on the source and the endpoint you're using.

If your source can only write raw events to the services/collector/raw, you have no additional metadata so you need three separate tokens - one for each sourcetype. However, if your source can write a proper json request to services/collector/event, you can provide sourcetype as a field in your request. Then the HEC-associated sourcetype works as a default assignment if one is not provided with the event. I don't remember if you don't have to provide allowed sourcetypes anyway.

Re: Help needed with HEC tokens

Roy_9 — Thu, 18 Nov 2021 20:02:39 GMT

Yes the source will send the events at services/collector/event, Since i can only select one sourcetype, i decided to create 3 different tokens for 3 sourcetypes which are tied to same index.I hope this will be easy to handle.

Thanks so much for your insight.

Re: Help needed with HEC tokens

Roy_9 — Fri, 19 Nov 2021 16:15:50 GMT

Upon validating with Support, I got to know if we want to use the same token for 3 sourcetypes, i was asked to add the sourcetype info manually at the source itself while pushing the payload to Splunk.