Getting Data In

Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header

nmadhok
Path Finder

Wanting to forward all raw events from Client/Application to a specified HTTP Event Collector (HEC) endpoint/URL for on-prem/self-hosted Splunk environment but Client/Application only allows for a URL to be specified and does not allow specifying the HEC token in authorization header for HTTP Authentication or including it in basic authentication request. 

How can the raw events be ingested into on-prem/self hosted Splunk using HTTP Event Collector (HEC) input without an Authorization header? Is it possible to specify the HEC token as a query string/parameter in the URL itself?

Labels (1)
0 Karma
1 Solution

nmadhok
Path Finder

Query string authentication can be enabled on a per-token basis.

  1. On the Splunk server, edit the file at $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf . Tokens are listed by name in this file, in the form http://<token_name> . 
  2. Within the stanza for each token that needs to enable query string authentication, add the following setting (or change the existing setting, if applicable): 
    allowQueryStringAuth = true
  3. Save and close the inputs.conf file and restart Splunk service to reload configuration.
For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release.

HEC token can then be specified as a query string in the URL in the format:

?token=<hec_token>

For example:

curl -k "https://my-splunk-hec.example.com:8088/services/collector/raw?token=91dfd4e5-da4f-4861-89dd-dcdec19067fb&channel=8cf7407d-fa98-4d97-9b7b-5f5902aa7744&sourcetype=mydata" -d '1, 2, 3... Hello, world!'

 

View solution in original post

nmadhok
Path Finder

Query string authentication can be enabled on a per-token basis.

  1. On the Splunk server, edit the file at $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf . Tokens are listed by name in this file, in the form http://<token_name> . 
  2. Within the stanza for each token that needs to enable query string authentication, add the following setting (or change the existing setting, if applicable): 
    allowQueryStringAuth = true
  3. Save and close the inputs.conf file and restart Splunk service to reload configuration.
For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release.

HEC token can then be specified as a query string in the URL in the format:

?token=<hec_token>

For example:

curl -k "https://my-splunk-hec.example.com:8088/services/collector/raw?token=91dfd4e5-da4f-4861-89dd-dcdec19067fb&channel=8cf7407d-fa98-4d97-9b7b-5f5902aa7744&sourcetype=mydata" -d '1, 2, 3... Hello, world!'

 

Matheus_Vieira
Explorer

This is awesome. Thanks much for sharing it!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...