Getting Data In

Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header

nmadhok
Path Finder

Wanting to forward all raw events from Client/Application to a specified HTTP Event Collector (HEC) endpoint/URL for on-prem/self-hosted Splunk environment but Client/Application only allows for a URL to be specified and does not allow specifying the HEC token in authorization header for HTTP Authentication or including it in basic authentication request. 

How can the raw events be ingested into on-prem/self hosted Splunk using HTTP Event Collector (HEC) input without an Authorization header? Is it possible to specify the HEC token as a query string/parameter in the URL itself?

Labels (1)
0 Karma
1 Solution

nmadhok
Path Finder

Query string authentication can be enabled on a per-token basis.

  1. On the Splunk server, edit the file at $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf . Tokens are listed by name in this file, in the form http://<token_name> . 
  2. Within the stanza for each token that needs to enable query string authentication, add the following setting (or change the existing setting, if applicable): 
    allowQueryStringAuth = true
  3. Save and close the inputs.conf file and restart Splunk service to reload configuration.
For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release.

HEC token can then be specified as a query string in the URL in the format:

?token=<hec_token>

For example:

curl -k "https://my-splunk-hec.example.com:8088/services/collector/raw?token=91dfd4e5-da4f-4861-89dd-dcdec19067fb&channel=8cf7407d-fa98-4d97-9b7b-5f5902aa7744&sourcetype=mydata" -d '1, 2, 3... Hello, world!'

 

View solution in original post

nmadhok
Path Finder

Query string authentication can be enabled on a per-token basis.

  1. On the Splunk server, edit the file at $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf . Tokens are listed by name in this file, in the form http://<token_name> . 
  2. Within the stanza for each token that needs to enable query string authentication, add the following setting (or change the existing setting, if applicable): 
    allowQueryStringAuth = true
  3. Save and close the inputs.conf file and restart Splunk service to reload configuration.
For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release.

HEC token can then be specified as a query string in the URL in the format:

?token=<hec_token>

For example:

curl -k "https://my-splunk-hec.example.com:8088/services/collector/raw?token=91dfd4e5-da4f-4861-89dd-dcdec19067fb&channel=8cf7407d-fa98-4d97-9b7b-5f5902aa7744&sourcetype=mydata" -d '1, 2, 3... Hello, world!'

 

View solution in original post

Matheus_Vieira
Explorer

This is awesome. Thanks much for sharing it!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!