Dashboards & Visualizations

multiple HEC tokens

aniketb
Path Finder

I have a HEC token where my security logs come in from cloud. The App team also wants to send the logs here.
What's the easiest way of implementing this while keeping the index and access to logs separate.

Is it allowed to have a separate HEC token with new index on the same port? That way security logs go to security HEC token and app logs go to app HEC token and no firewall changes are needed

Tags (1)
0 Karma
1 Solution

masonmorales
Influencer

Yes, it's possible. Take a look at https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ for examples on how to generate GUIDs for new HEC tokens. You then add the GUID as a new http stanza in inputs.conf with the corresponding indexes it can access.

Here's what your config might look like

[http]
disabled=0
port=8088
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

[http://security]
disabled = 0
index = syslog
indexes = wineventlog,cisco,antivirus
sourcetype = syslog
token = 49775a02-74d0-43e1-845f-d57d0558bd45
useACK = 0

[http://applications]
disabled = 0
index = syslog
indexes = apache,myapp,etc
sourcetype = syslog
token = 0880377a-3d06-4da5-a36c-cea9e2022d40
useACK = 0

View solution in original post

masonmorales
Influencer

Yes, it's possible. Take a look at https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ for examples on how to generate GUIDs for new HEC tokens. You then add the GUID as a new http stanza in inputs.conf with the corresponding indexes it can access.

Here's what your config might look like

[http]
disabled=0
port=8088
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

[http://security]
disabled = 0
index = syslog
indexes = wineventlog,cisco,antivirus
sourcetype = syslog
token = 49775a02-74d0-43e1-845f-d57d0558bd45
useACK = 0

[http://applications]
disabled = 0
index = syslog
indexes = apache,myapp,etc
sourcetype = syslog
token = 0880377a-3d06-4da5-a36c-cea9e2022d40
useACK = 0
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...