Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header

[nmadhok]

Wanting to forward all raw events from Client/Application to a specified HTTP Event Collector (HEC) endpoint/URL for on-prem/self-hosted Splunk environment but Client/Application only allows for a URL to be specified and does not allow specifying the HEC token in authorization header for HTTP Authentication or including it in basic authentication request. 

How can the raw events be ingested into on-prem/self hosted Splunk using HTTP Event Collector (HEC) input without an Authorization header? Is it possible to specify the HEC token as a query string/parameter in the URL itself?

[kpatil]

I'm doing POC using Splunk Trail and HEC to ingest audit log from Enterprise CMS [Sitecore], Sitecore doesn't support Authorization Header. So, I would like to enable query string authorization for my trail splunk cloud instance. But I'm unable to create ticket as one of the option is loading, tried call etc. But no luck. Can anyone help me getting connected to  splunk support?

"

For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release.

As per above comment, this configuration is added in splunk web? I couldn't find it. But might be looking at wrong place. Thanks, appreciate your help!

[nmadhok · Accepted solution]

Query string authentication can be enabled on a per-token basis.

1. On the Splunk server, edit the file at $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf . Tokens are listed by name in this file, in the form http://<token_name> . 
2. Within the stanza for each token that needs to enable query string authentication, add the following setting (or change the existing setting, if applicable): 

   allowQueryStringAuth = true

3. Save and close the inputs.conf file and restart Splunk service to reload configuration.

For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release.

HEC token can then be specified as a query string in the URL in the format:

?token=<hec_token>

For example:

curl -k "https://my-splunk-hec.example.com:8088/services/collector/raw?token=91dfd4e5-da4f-4861-89dd-dcdec19067fb&channel=8cf7407d-fa98-4d97-9b7b-5f5902aa7744&sourcetype=mydata" -d '1, 2, 3... Hello, world!'

[Matheus_Vieira]

This is awesome. Thanks much for sharing it!