Dashboards & Visualizations

multiple HEC tokens

aniketb
Path Finder

I have a HEC token where my security logs come in from cloud. The App team also wants to send the logs here.
What's the easiest way of implementing this while keeping the index and access to logs separate.

Is it allowed to have a separate HEC token with new index on the same port? That way security logs go to security HEC token and app logs go to app HEC token and no firewall changes are needed

Tags (1)
0 Karma
1 Solution

masonmorales
Influencer

Yes, it's possible. Take a look at https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ for examples on how to generate GUIDs for new HEC tokens. You then add the GUID as a new http stanza in inputs.conf with the corresponding indexes it can access.

Here's what your config might look like

[http]
disabled=0
port=8088
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

[http://security]
disabled = 0
index = syslog
indexes = wineventlog,cisco,antivirus
sourcetype = syslog
token = 49775a02-74d0-43e1-845f-d57d0558bd45
useACK = 0

[http://applications]
disabled = 0
index = syslog
indexes = apache,myapp,etc
sourcetype = syslog
token = 0880377a-3d06-4da5-a36c-cea9e2022d40
useACK = 0

View solution in original post

masonmorales
Influencer

Yes, it's possible. Take a look at https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ for examples on how to generate GUIDs for new HEC tokens. You then add the GUID as a new http stanza in inputs.conf with the corresponding indexes it can access.

Here's what your config might look like

[http]
disabled=0
port=8088
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

[http://security]
disabled = 0
index = syslog
indexes = wineventlog,cisco,antivirus
sourcetype = syslog
token = 49775a02-74d0-43e1-845f-d57d0558bd45
useACK = 0

[http://applications]
disabled = 0
index = syslog
indexes = apache,myapp,etc
sourcetype = syslog
token = 0880377a-3d06-4da5-a36c-cea9e2022d40
useACK = 0
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...