topic Re: Is it possible to have several indixes associated with the same HEC and send logs to only one through POST? in Getting Data In

Is it possible to have several indixes associated with the same HEC and send logs to only one through POST?

flck — Thu, 05 Dec 2019 12:43:20 GMT

Hello, I am using Splunk Cloud and I need to have several indixes "AAAA", "BBBB", "CCCC", "DDDD" associated to the same HEC, I am trying to insert logs to a specific index indicating the index through POST, but the logs They are always inserted into the Default Index.
Is it possible to use the same HEC for several indixes and specify only one when you are going to insert the logs by POST?

Thanks in advance.

Re: Is it possible to have several indixes associated with the same HEC and send logs to only one through POST?

woodcock — Thu, 05 Dec 2019 15:13:10 GMT

The index is paired with the token and you can create as many tokens as you like. What are you trying to do? Are you trying to send the same data to multiple indexERS? Are you trying to send the same data to multiple indICES? Are you trying to send data to an indEX not paired with your token (not possible)?

Re: Is it possible to have several indixes associated with the same HEC and send logs to only one through POST?

flck — Wed, 30 Sep 2020 03:16:14 GMT

Hello everyone, thanks for your replies.
I was able to solve it, finally I created a new HEC in the HTTP Event Collector and associated to it all my 4 indixes to this new HEC, then using python, my main connection function is this:

import json
import requests

class PyHEC:
def init(self, token, uri):
if not 'http' in uri:
raise("no http or https found in hostname")
self.token = token
self.uri = uri+"/services/collector/event"
def send(self, event, metadata=None):
headers = {'Authorization': 'Splunk '+self.token}
payload = {"host": self.uri,
"event": event}
if metadata:
payload.update(metadata)
r = requests.post(self.uri, data=json.dumps(payload), headers=headers, verify=True if 'https' in self.uri else False)
return r.status_code, r.text,

The class call is made every time you need to make an input to a different index.

hec = PyHEC('HEC_PASSWORD', "URL")
try:
data = open('FILE1.json','r')
event = (data.read())
metadata = {"index":"INDEX_AAAA", "host":"HOST_INPUT"}
print hec.send(event, metadata)
except Exception as e:
print('Error')
try:
data = open('FILE2.json','r')
event = (data.read())
metadata = {"index":"INDEX_BBBB", "host":"HOST_INPUT"}
print hec.send(event, metadata)
except Exception as e:
print('Error')

I will consider the answer solved. Regards.

Re: Is it possible to have several indixes associated with the same HEC and send logs to only one through POST?

woodcock — Fri, 06 Dec 2019 17:38:56 GMT

I also thought of another way besides CLONE_SOURCETYPE (which doesn't at all do what you need it to). You should be able to use INGEST_EVAL = index = YourIndexHere to override anything, provided you can find an appropriate stanza header to associate this setting only to your HEC stuff, probably [source::...].