Deployment Architecture

Tcpinput whit tokens: how to specify the destination index?

gc_os76
Explorer

Hi all,

I'm trying to configure a tcpinput endpoint configuration in a way which makes me able to route incoming traffic in a few indexes.

I'm trying to use tokens to do this.

From Splunk web gui I can see that is possible to bind an HEC token to a certain index.

It seems I'm not able to do the same with the TCP tokens.

I've been following this documentation to define my token:

https://docs.splunk.com/Documentation/Forwarder/8.0.5/Forwarder/Controlforwarderaccess

and then defining this on my indexer instance's inputs.conf file:

[splunktcp://9997]
disabled = 0
index = minikube_on_hs9

[splunktcptoken://my_token]
disabled = 0
index = minikube_on_hs9
token = $7$qlaEJcxHynjqXZHqCddO61xXxB/FUh/aooVPVFvjBEde9OnUZPx6Oz/Te8ye0lJKR/3tkNuCXjK8ccPLsKARgNAIkSg=

 

after a restart of Splunk, the status of the token was as the one showed in the attached screenshot.

At the moment of creation, the token seemed associated to the default index, though.

On my test client, in the outputs.conf file, I have something like this:

[tcpout]
defaultGroup = tcpin-sre-tools

token = $7$2ygFLiflfLjPs/n/jXxuOBI/aSgTK/Hwf+IcSSMkAtt6V+ATWCbOm4+95VpVPag05bco0qjlMuEckfcxtZDBa7h1fu0=

[tcpout:tcpin-sre-tools]

server = my_server_name:9997

 

No error related to token missing or mismatch, but still unable to address logs from my client into the specified index on the Splunk side. The logs get injected in the main index.

Any idea how to fix this?

 

Best regards,

Giuseppe

 

 

0 Karma
1 Solution

gc_os76
Explorer

It seems the problem was a missing info in my client's inputs.conf.

The destination index needed to be specified this way:

 

[monitor:///tmp/instance.log]
disabled=false
sourcetype = generic_single_line
index = minikube_on_hs9

View solution in original post

0 Karma

gc_os76
Explorer

It seems the problem was a missing info in my client's inputs.conf.

The destination index needed to be specified this way:

 

[monitor:///tmp/instance.log]
disabled=false
sourcetype = generic_single_line
index = minikube_on_hs9

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...