I'm trying to configure a tcpinput endpoint configuration in a way which makes me able to route incoming traffic in a few indexes.
I'm trying to use tokens to do this.
From Splunk web gui I can see that is possible to bind an HEC token to a certain index.
It seems I'm not able to do the same with the TCP tokens.
I've been following this documentation to define my token:
and then defining this on my indexer instance's inputs.conf file:
[splunktcp://9997]disabled = 0index = minikube_on_hs9
[splunktcptoken://my_token]disabled = 0index = minikube_on_hs9token = $7$qlaEJcxHynjqXZHqCddO61xXxB/FUh/aooVPVFvjBEde9OnUZPx6Oz/Te8ye0lJKR/3tkNuCXjK8ccPLsKARgNAIkSg=
after a restart of Splunk, the status of the token was as the one showed in the attached screenshot.
At the moment of creation, the token seemed associated to the default index, though.
On my test client, in the outputs.conf file, I have something like this:
[tcpout]defaultGroup = tcpin-sre-tools
token = $7$2ygFLiflfLjPs/n/jXxuOBI/aSgTK/Hwf+IcSSMkAtt6V+ATWCbOm4+95VpVPag05bco0qjlMuEckfcxtZDBa7h1fu0=
server = my_server_name:9997
No error related to token missing or mismatch, but still unable to address logs from my client into the specified index on the Splunk side. The logs get injected in the main index.
Any idea how to fix this?
It seems the problem was a missing info in my client's inputs.conf.
The destination index needed to be specified this way:
[monitor:///tmp/instance.log]disabled=falsesourcetype = generic_single_lineindex = minikube_on_hs9
View solution in original post