Getting Data In

How to force to set certain fields (host and sourcetype) for events from HEC local stanza for each token

Path Finder

Is it possible to force Splunk to set up specific fields (sourcetype, source, host) from HEC local stanza
but not from event parameters?

For example if i have inputs.conf like:

description = test hec input
disabled = 0
connection_host = dns
index = main
source = test_hec_source
sourcetype = test_hec_sourcetype

Client can rewrite index, host, source and sourcetype if post in data json like:

  "host": fake_host,
  "sourcetype": fake_sourcetype,
  "index": fake_index,
  "source": fake_source

But in certain situations i need to deny modifications of this parameters. Of course i can do it with transforms.conf, but it is not convinient.


You should be able to override source and define sourcetype for HEC during configuration I know for sure. I don't believe you can for host. You should also be able to override fields using props and transforms at the indexers.


[<original sourcetype>]
TRANSFORMS-force_host = force_host
TRANSFORMS-force_source = force_source


FORMAT = <your_host>

FORMAT = <your_source>

FORMAT = <your_sourcetype>

The only thing I am unsure of is Splunk's order of operations. If it changes the sourcetype first, would it no longer see that sourcetype for the event and skip the host and source override? I would have to test but, if so, you should be able to just create a new stanza for the new sourcetype.

0 Karma

Path Finder

you are right about HEC configuration if sourcetype, host and over fields are not defined in event.
But if sender define this fields, he will override valued defined in inputs.conf.

0 Karma


In HEC configs, source/sourcetype settings come under the "per-token" settings:

0 Karma