Getting Data In

Multiple SplunkTCPTokens on inputs.conf

New Member

We are looking to utilize the splunktcptoken as additional security measure to validate that we trust the sender of data at the intermediary forwarding layer. We would like to be able to rotate the tokens periodically - during the rotation it is possible that some hosts may lag in receiving the new token. Is it possible to configure multiple tokens at once in the same inputs.conf?

I assume it could look something like this:

token = new_token123

token = old_token123

Then at rotation time we move the new token to the old token stanza and create the new token in the new token stanza. Believe this should work but just looking for a positive confirmation or if there is something obvious I'm missing with this approach - like can we have multiple tokens in a single stanza.

token = old_token123
token = new_token123

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...