Getting Data In

Multiple SplunkTCPTokens on inputs.conf

New Member

We are looking to utilize the splunktcptoken as additional security measure to validate that we trust the sender of data at the intermediary forwarding layer. We would like to be able to rotate the tokens periodically - during the rotation it is possible that some hosts may lag in receiving the new token. Is it possible to configure multiple tokens at once in the same inputs.conf?

I assume it could look something like this:

token = new_token123

token = old_token123

Then at rotation time we move the new token to the old token stanza and create the new token in the new token stanza. Believe this should work but just looking for a positive confirmation or if there is something obvious I'm missing with this approach - like can we have multiple tokens in a single stanza.

token = old_token123
token = new_token123

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...