Dashboards & Visualizations

multiple HEC tokens

aniketb
Path Finder

I have a HEC token where my security logs come in from cloud. The App team also wants to send the logs here.
What's the easiest way of implementing this while keeping the index and access to logs separate.

Is it allowed to have a separate HEC token with new index on the same port? That way security logs go to security HEC token and app logs go to app HEC token and no firewall changes are needed

Tags (1)
0 Karma
1 Solution

masonmorales
Influencer

Yes, it's possible. Take a look at https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ for examples on how to generate GUIDs for new HEC tokens. You then add the GUID as a new http stanza in inputs.conf with the corresponding indexes it can access.

Here's what your config might look like

[http]
disabled=0
port=8088
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

[http://security]
disabled = 0
index = syslog
indexes = wineventlog,cisco,antivirus
sourcetype = syslog
token = 49775a02-74d0-43e1-845f-d57d0558bd45
useACK = 0

[http://applications]
disabled = 0
index = syslog
indexes = apache,myapp,etc
sourcetype = syslog
token = 0880377a-3d06-4da5-a36c-cea9e2022d40
useACK = 0

View solution in original post

masonmorales
Influencer

Yes, it's possible. Take a look at https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ for examples on how to generate GUIDs for new HEC tokens. You then add the GUID as a new http stanza in inputs.conf with the corresponding indexes it can access.

Here's what your config might look like

[http]
disabled=0
port=8088
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

[http://security]
disabled = 0
index = syslog
indexes = wineventlog,cisco,antivirus
sourcetype = syslog
token = 49775a02-74d0-43e1-845f-d57d0558bd45
useACK = 0

[http://applications]
disabled = 0
index = syslog
indexes = apache,myapp,etc
sourcetype = syslog
token = 0880377a-3d06-4da5-a36c-cea9e2022d40
useACK = 0
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...