We are looking to utilize the splunktcptoken as additional security measure to validate that we trust the sender of data at the intermediary forwarding layer. We would like to be able to rotate the tokens periodically - during the rotation it is possible that some hosts may lag in receiving the new token. Is it possible to configure multiple tokens at once in the same inputs.conf?
I assume it could look something like this:
[splunktcptoken://new]
token = new_token123
[splunktcptoken://old]
token = old_token123
Then at rotation time we move the new token to the old token stanza and create the new token in the new token stanza. Believe this should work but just looking for a positive confirmation or if there is something obvious I'm missing with this approach - like can we have multiple tokens in a single stanza.
[splunktcptoken://tok1]
token = old_token123
token = new_token123
