Getting Data In

Is it possible to have several indixes associated with the same HEC and send logs to only one through POST?

flck
Path Finder

Hello, I am using Splunk Cloud and I need to have several indixes "AAAA", "BBBB", "CCCC", "DDDD" associated to the same HEC, I am trying to insert logs to a specific index indicating the index through POST, but the logs They are always inserted into the Default Index.
Is it possible to use the same HEC for several indixes and specify only one when you are going to insert the logs by POST?

Thanks in advance.

0 Karma
1 Solution

flck
Path Finder

Hello everyone, thanks for your replies.
I was able to solve it, finally I created a new HEC in the HTTP Event Collector and associated to it all my 4 indixes to this new HEC, then using python, my main connection function is this:

import json
import requests

class PyHEC:
def init(self, token, uri):
if not 'http' in uri:
raise("no http or https found in hostname")
self.token = token
self.uri = uri+"/services/collector/event"
def send(self, event, metadata=None):
headers = {'Authorization': 'Splunk '+self.token}
payload = {"host": self.uri,
"event": event}
if metadata:
payload.update(metadata)
r = requests.post(self.uri, data=json.dumps(payload), headers=headers, verify=True if 'https' in self.uri else False)
return r.status_code, r.text,

The class call is made every time you need to make an input to a different index.

hec = PyHEC('HEC_PASSWORD', "URL")
try:
data = open('FILE1.json','r')
event = (data.read())
metadata = {"index":"INDEX_AAAA", "host":"HOST_INPUT"}
print hec.send(event, metadata)
except Exception as e:
print('Error')
try:
data = open('FILE2.json','r')
event = (data.read())
metadata = {"index":"INDEX_BBBB", "host":"HOST_INPUT"}
print hec.send(event, metadata)
except Exception as e:
print('Error')

I will consider the answer solved. Regards.

View solution in original post

0 Karma

woodcock
Esteemed Legend

I also thought of another way besides CLONE_SOURCETYPE (which doesn't at all do what you need it to). You should be able to use INGEST_EVAL = index = YourIndexHere to override anything, provided you can find an appropriate stanza header to associate this setting only to your HEC stuff, probably [source::...].

0 Karma

flck
Path Finder

Hello everyone, thanks for your replies.
I was able to solve it, finally I created a new HEC in the HTTP Event Collector and associated to it all my 4 indixes to this new HEC, then using python, my main connection function is this:

import json
import requests

class PyHEC:
def init(self, token, uri):
if not 'http' in uri:
raise("no http or https found in hostname")
self.token = token
self.uri = uri+"/services/collector/event"
def send(self, event, metadata=None):
headers = {'Authorization': 'Splunk '+self.token}
payload = {"host": self.uri,
"event": event}
if metadata:
payload.update(metadata)
r = requests.post(self.uri, data=json.dumps(payload), headers=headers, verify=True if 'https' in self.uri else False)
return r.status_code, r.text,

The class call is made every time you need to make an input to a different index.

hec = PyHEC('HEC_PASSWORD', "URL")
try:
data = open('FILE1.json','r')
event = (data.read())
metadata = {"index":"INDEX_AAAA", "host":"HOST_INPUT"}
print hec.send(event, metadata)
except Exception as e:
print('Error')
try:
data = open('FILE2.json','r')
event = (data.read())
metadata = {"index":"INDEX_BBBB", "host":"HOST_INPUT"}
print hec.send(event, metadata)
except Exception as e:
print('Error')

I will consider the answer solved. Regards.

0 Karma

woodcock
Esteemed Legend

The index is paired with the token and you can create as many tokens as you like. What are you trying to do? Are you trying to send the same data to multiple indexERS? Are you trying to send the same data to multiple indICES? Are you trying to send data to an indEX not paired with your token (not possible)?

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...