Query string method not working for HEC on Cloud

naiktej13 — Thu, 11 May 2017 10:00:38 GMT

I have a splunk cloud stack which has HEC enabled on it and I am referring following page to send data via HEC:
http://dev.splunk.com/view/event-collector/SP-CAAAE7G

which have mentioned 3 ways:
1. HTTP Authentication
2. Basic authentication
3. Query string

Among them, 1 and 2 are working properly. But when I tried to send data via "Query string" it gives following Error:

{"text":"Query string authorization is not enabled","code":16}

Any idea regarding How to enable the "Query string" in cloud stack?

Re: Query string method not working for HEC on Cloud

hunters_splunk — Thu, 11 May 2017 14:19:20 GMT

Hi Naiktej13,

Seems that the allowQueryStringAuth has not been set to true in the HEC local stanza in your Cloud instance:
allowQueryStringAuth = [true|false]
For detailed information about his setting, see http://docs.splunk.com/Documentation/Splunk/6.6.0/Admin/Inputsconf#HTTP_Event_Collector_.28HEC.29_-_Local_stanza_for_each_token .

Please contact your Cloud administrator to set allowQueryStringAuth to true to Enable sending authorization token with query string.

Hope it helps. Thanks!
Hunter