- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to create HEC token through an API call?
Would like to create an HEC token based on an api call.
Whenever a new instance (EC2) is coming up, it would make a call to splunk enterprise using the api gateway. splunk enterpise may need to create an HEC token and send a response back to the EC2 instance.
Later, the HEC token created will be mapped to an index and other conf file would be changed.
Question is:
"Is there a way to create HEC token on API call ?"
post the creation of HEC token, is there a way to find the same
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
well after searching a bit, i got this link which suggest what needs to be done
https://docs.splunk.com/Documentation/Splunk/8.0.6/RESTTUT/RESTandCloud
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi there,
curl -u admin:pass https://localhost:8089/servicesNS/nobody/search/data/inputs/http -d name=myapp
above curl works well and generates token.
How to replicate same for self-service Splunk Cloud as i have tried above command on my trial Splunk Cloud account with below command
```
curl -k -v -u admin:pass https://prd-p-aadrg.splunkcloud.com:8089/servicesNS/nobody/search/data/inputs/http -d name=myapp
```
and nmap shows that only three ports are open
```
Starting Nmap 7.60 ( https://nmap.org ) at 2020-10-14 11:30 IST
Nmap scan report for prd-p-aadrg.splunkcloud.com (100.24.234.228)
Host is up (0.23s latency).
rDNS record for 100.24.234.228: ec2-100-24-234-228.compute-1.amazonaws.com
Not shown: 9998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
8088/tcp open radan-http
```
same above command on port 8088 returns below error
```
{"text":"The requested URL was not found on this server.","code":404}
```
So how to create http-event token for Self-service Splunk Cloud using REST api calls.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

,You might be able to solve this as below
- Use curl to get token
- build conf file -> upload it to a git repo/s3 and then a schedule job sync these conf files to Splunk deployment server.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi,
Yes you can create HEC Token using Splunk REST API , have a look at this documentation https://docs.splunk.com/Documentation/Splunk/7.2.5/RESTREF/RESTinput#data.2Finputs.2Fhttp
I have created sample token in my lab and it is working fine and below command I have used. You can create python script to achieve this and when you fire below REST API it will provide Response in which token value will be there
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/data/inputs/http -d name=test -d index=main -d indexes=main,summary
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it is possible to call a script to create a index.conf file, on completion of above said Restapi call.
would like to create the HEC using dummy index, then a script to create index.conf to deploy across the index cluster. post index.conf deployment, a script to call input.conf to update the index name.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Can you see this help
- curl command to get token
- build conf files and then move them in a git repo
- have a schedule sync job to sync all conf file between git repo and deployment server
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You can create python script with Splunk Python SDK to create HEC token and then when you will get 200 response from Splunk invoke your other script.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have an example of the rest call you used to create the HEC?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@harsmarvania57 you mention creating HEC using Splunk Python SDK - would you please elaborate on that as I could not find anything on this in the SDK doc. Kindly please help.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
appreciate your help so far,
my requirement is.....
1) for a api call from EC2 instance,Create a HEC token and send a respond back .
2) on creating HEC token, further do a subsequent call to create index.conf, auth.conf and deploy it to the cluster.
so far i have achieved the step 1, HEC token got created and responded back to the API call with HEC token.
Now,would like to know, how can i do a subsequent call(post the Rest api call to create HEC token) to create index.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the help.
Yes, using the curl command, i have created the HEC token. but my requirement here is.
1) On Creating HEC token using a dummy index. should trigger a script, which should in-turn create the index.conf and push it to deployment server and then callback rest api to update the index details in input.conf for respective HEC token.
the challenge it to invoke a script, on creation of HEC token
