Hello,
I have an index and 3 custom sourcetypes built in place, Suppose if the source wants to stream logs into Splunk, do i need to create 3 HEC tokens? I can see when i am trying to create HEC inputs, it is asking me to select sourcetype where i can only select one sourcetype.
Please help me with this situation.
Thanks
Upon validating with Support, I got to know if we want to use the same token for 3 sourcetypes, i was asked to add the sourcetype info manually at the source itself while pushing the payload to Splunk.
It depends on the source and the endpoint you're using.
If your source can only write raw events to the services/collector/raw, you have no additional metadata so you need three separate tokens - one for each sourcetype. However, if your source can write a proper json request to services/collector/event, you can provide sourcetype as a field in your request. Then the HEC-associated sourcetype works as a default assignment if one is not provided with the event. I don't remember if you don't have to provide allowed sourcetypes anyway.
Yes the source will send the events at services/collector/event, Since i can only select one sourcetype, i decided to create 3 different tokens for 3 sourcetypes which are tied to same index.I hope this will be easy to handle.
Thanks so much for your insight.
Upon validating with Support, I got to know if we want to use the same token for 3 sourcetypes, i was asked to add the sourcetype info manually at the source itself while pushing the payload to Splunk.