HEC Token with multiple indexes not working properly

[ripleyramirocas]

Hi,

I have configured a HEC Token with two different indexes (at my work we have lots of apps that are being used by two countries, for example, index APP_C1 and index APP_C2). The thing is that I want to have one token per app and configure the scripts so it can send data to the respective country index independently.

So, my HEC is configured with those two indexes, the thing is that it only works for the first one. I've tried with other HECs configured with more indexes and the problem happens the same way.

I'm using the NPM package called "splunk-logging". And the error I get is
"Response from Splunk { text: 'Incorrect index', code: 7, 'invalid-event-number': 1 } APP_C2"

I've been searching for a while with no luck. Please help!

[dhihoriya_splun]

Hi @ripleyramirocastillo93

If you want to add more than one indexes under one HEC token then you have to add below config under HEC token stanza in inputs.conf :

[HEC Token name]
Indexes = All the index name that you want to send the data by a comma-separated

If you are using Splunk-cloud then you have to raise a support case to add this config under HEC token stanza.

I hope this will help you.

Thanks,
Dixit