Getting Data In

Multiple SplunkTCPTokens on inputs.conf

wbw4am
New Member

We are looking to utilize the splunktcptoken as additional security measure to validate that we trust the sender of data at the intermediary forwarding layer. We would like to be able to rotate the tokens periodically - during the rotation it is possible that some hosts may lag in receiving the new token. Is it possible to configure multiple tokens at once in the same inputs.conf?

I assume it could look something like this:

[splunktcptoken://new]
token = new_token123

[splunktcptoken://old]
token = old_token123

Then at rotation time we move the new token to the old token stanza and create the new token in the new token stanza. Believe this should work but just looking for a positive confirmation or if there is something obvious I'm missing with this approach - like can we have multiple tokens in a single stanza.

[splunktcptoken://tok1]
token = old_token123
token = new_token123

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...