Deployment Architecture

Enable Deployment and HEC tokens in Global settings

SecurityFeller
Explorer

We are generating HEC tokens on a deployment server and pushing them out to the HECs. 

HEC tokens are disabled by default on the HECs and the deployment server and need to be enabled in global settings. 

What I've done so far is:

-authorize.conf, this is for user tokens and isn't working for HEC tokens

-the CLI command for token enable isn't working because it's not enabled globally

-inputs.conf has [http] disabled=0

 

The only thing that has worked is enabling it via the UI. Is there a way to enable these over CLI?

0 Karma
1 Solution

SecurityFeller
Explorer

Solved. Splunk did not take conf file enablement on creation. It must be modified afterwards. 

View solution in original post

SecurityFeller
Explorer

Solved. Splunk did not take conf file enablement on creation. It must be modified afterwards. 

Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...