Building for the Splunk Platform

Is there a way to change the token prefix from splunk to bearer?

nareshkumarg
Path Finder

Hi All,

We are trying to push data from Grafana to Splunk using HEC based integration. When we did the testing we found that the header sent by Grafana was in the following format "Bearer <HEC TOKEN>" instead of "splunk <HEC TOKEN>" format.

Because of this, authentication failed and we cannot ingest data into Splunk. We manually tried the same via postman where we have an option to change the Bearer prefix and it worked. Our ask is, do we have a method to change the Header Authorization from Splunk to Bearer to fix the authentication issue?

Please help.

Regards,

Naresh

Labels (3)
0 Karma
1 Solution

thambisetty
Super Champion

thambisetty
Super Champion

May be useful.

https://community.splunk.com/t5/Getting-Data-In/Posting-data-to-HTTP-Event-Collector-HEC-without-pas...

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...