https://community.splunk.com/t5/Dashboards-Visualizations/Recreate-HEC-token-on-server/m-p/378280#M24739 <P>I'm not aware of a way to programmatically create tokens with a specific value but Splunk explains the configuration format at <A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/UseHECusingconffiles">http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/UseHECusingconffiles</A> and editing the config file manually should work fine. I would probably create the tokens in the GUI, then locate the appropriate inputs.conf on the file system (probably $SPLUNK_HOME/etc/apps/launcher/local/inputs.conf) and edit the values there. Restarting Splunk will make the changes take effect. Good luck!</P> Mon, 11 Jun 2018 20:55:52 GMT jtacy 2018-06-11T20:55:52Z https://community.splunk.com/t5/Dashboards-Visualizations/Recreate-HEC-token-on-server/m-p/378279#M24738 <P>My sandbox splunk instance crashed and I am not able to restore the data. I need to restore my Splunk HEC tokens and settings. Whenever I try to create a new HEC token, Splunk generates a random HEC token id. How do i create a new HEC token with a predefined token id of my choice?</P> <P>Is it possible to do this through a curl command? If so can you provide instructions or example? </P> Fri, 08 Jun 2018 13:45:51 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Recreate-HEC-token-on-server/m-p/378279#M24738 spammenot66 2018-06-08T13:45:51Z https://community.splunk.com/t5/Dashboards-Visualizations/Recreate-HEC-token-on-server/m-p/378280#M24739 <P>I'm not aware of a way to programmatically create tokens with a specific value but Splunk explains the configuration format at <A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/UseHECusingconffiles">http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/UseHECusingconffiles</A> and editing the config file manually should work fine. I would probably create the tokens in the GUI, then locate the appropriate inputs.conf on the file system (probably $SPLUNK_HOME/etc/apps/launcher/local/inputs.conf) and edit the values there. Restarting Splunk will make the changes take effect. Good luck!</P> Mon, 11 Jun 2018 20:55:52 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Recreate-HEC-token-on-server/m-p/378280#M24739 jtacy 2018-06-11T20:55:52Z