Dashboards & Visualizations

multiple HEC tokens

aniketb
Path Finder

I have a HEC token where my security logs come in from cloud. The App team also wants to send the logs here.
What's the easiest way of implementing this while keeping the index and access to logs separate.

Is it allowed to have a separate HEC token with new index on the same port? That way security logs go to security HEC token and app logs go to app HEC token and no firewall changes are needed

Tags (1)
0 Karma
1 Solution

masonmorales
Influencer

Yes, it's possible. Take a look at https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ for examples on how to generate GUIDs for new HEC tokens. You then add the GUID as a new http stanza in inputs.conf with the corresponding indexes it can access.

Here's what your config might look like

[http]
disabled=0
port=8088
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

[http://security]
disabled = 0
index = syslog
indexes = wineventlog,cisco,antivirus
sourcetype = syslog
token = 49775a02-74d0-43e1-845f-d57d0558bd45
useACK = 0

[http://applications]
disabled = 0
index = syslog
indexes = apache,myapp,etc
sourcetype = syslog
token = 0880377a-3d06-4da5-a36c-cea9e2022d40
useACK = 0

View solution in original post

masonmorales
Influencer

Yes, it's possible. Take a look at https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ for examples on how to generate GUIDs for new HEC tokens. You then add the GUID as a new http stanza in inputs.conf with the corresponding indexes it can access.

Here's what your config might look like

[http]
disabled=0
port=8088
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

[http://security]
disabled = 0
index = syslog
indexes = wineventlog,cisco,antivirus
sourcetype = syslog
token = 49775a02-74d0-43e1-845f-d57d0558bd45
useACK = 0

[http://applications]
disabled = 0
index = syslog
indexes = apache,myapp,etc
sourcetype = syslog
token = 0880377a-3d06-4da5-a36c-cea9e2022d40
useACK = 0
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...