Getting Data In

Help needed with HEC tokens

Roy_9
Motivator

Hello,

I have an index and 3 custom sourcetypes built in place, Suppose if the source wants to stream logs into Splunk, do i need to create 3 HEC tokens? I can see when i am trying to create HEC inputs, it is asking me to select sourcetype where i can only select one sourcetype.

Please help me with this situation.

 

Thanks

Labels (2)
0 Karma
1 Solution

Roy_9
Motivator

Upon validating with Support, I got to know if we want to use the same token for 3 sourcetypes, i was asked to add the sourcetype info manually at the source itself while pushing the payload to Splunk.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It depends on the source and the endpoint you're using.

If your source can only write raw events to the services/collector/raw, you have no additional metadata so you need three separate tokens - one for each sourcetype. However, if your source can write a proper json request to services/collector/event, you can provide sourcetype as a field in your request. Then the HEC-associated sourcetype works as a default assignment if one is not provided with the event. I don't remember if you don't have to provide allowed sourcetypes anyway.

Roy_9
Motivator

Yes the source will send the events at services/collector/event, Since i can only select one sourcetype, i decided to create 3 different tokens for 3 sourcetypes which are tied to same index.I hope this will be easy to handle.

Thanks so much for your insight.

0 Karma

Roy_9
Motivator

Upon validating with Support, I got to know if we want to use the same token for 3 sourcetypes, i was asked to add the sourcetype info manually at the source itself while pushing the payload to Splunk.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...