Getting Data In

Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header

nmadhok
Path Finder

Wanting to forward all raw events from Client/Application to a specified HTTP Event Collector (HEC) endpoint/URL for on-prem/self-hosted Splunk environment but Client/Application only allows for a URL to be specified and does not allow specifying the HEC token in authorization header for HTTP Authentication or including it in basic authentication request. 

How can the raw events be ingested into on-prem/self hosted Splunk using HTTP Event Collector (HEC) input without an Authorization header? Is it possible to specify the HEC token as a query string/parameter in the URL itself?

Labels (1)
0 Karma
1 Solution

nmadhok
Path Finder

Query string authentication can be enabled on a per-token basis.

  1. On the Splunk server, edit the file at $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf . Tokens are listed by name in this file, in the form http://<token_name> . 
  2. Within the stanza for each token that needs to enable query string authentication, add the following setting (or change the existing setting, if applicable): 
    allowQueryStringAuth = true
  3. Save and close the inputs.conf file and restart Splunk service to reload configuration.
For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release.

HEC token can then be specified as a query string in the URL in the format:

?token=<hec_token>

For example:

curl -k "https://my-splunk-hec.example.com:8088/services/collector/raw?token=91dfd4e5-da4f-4861-89dd-dcdec19067fb&channel=8cf7407d-fa98-4d97-9b7b-5f5902aa7744&sourcetype=mydata" -d '1, 2, 3... Hello, world!'

 

View solution in original post

nmadhok
Path Finder

Query string authentication can be enabled on a per-token basis.

  1. On the Splunk server, edit the file at $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf . Tokens are listed by name in this file, in the form http://<token_name> . 
  2. Within the stanza for each token that needs to enable query string authentication, add the following setting (or change the existing setting, if applicable): 
    allowQueryStringAuth = true
  3. Save and close the inputs.conf file and restart Splunk service to reload configuration.
For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release.

HEC token can then be specified as a query string in the URL in the format:

?token=<hec_token>

For example:

curl -k "https://my-splunk-hec.example.com:8088/services/collector/raw?token=91dfd4e5-da4f-4861-89dd-dcdec19067fb&channel=8cf7407d-fa98-4d97-9b7b-5f5902aa7744&sourcetype=mydata" -d '1, 2, 3... Hello, world!'

 

Matheus_Vieira
Explorer

This is awesome. Thanks much for sharing it!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...