Is there a way to change the token prefix from splunk to bearer?

[nareshkumarg]

Hi All,

We are trying to push data from Grafana to Splunk using HEC based integration. When we did the testing we found that the header sent by Grafana was in the following format "Bearer <HEC TOKEN>" instead of "splunk <HEC TOKEN>" format.

Because of this, authentication failed and we cannot ingest data into Splunk. We manually tried the same via postman where we have an option to change the Bearer prefix and it worked. Our ask is, do we have a method to change the Header Authorization from Splunk to Bearer to fix the authentication issue?

Please help.

Regards,

Naresh

[richgalloway]

You might need to ask on a Grafana forum or contact them for support.

[nareshkumarg · Accepted solution]

I used this and it helped.

https://community.splunk.com/t5/Getting-Data-In/Posting-data-to-HTTP-Event-Collector-HEC-without-pas...