Posting data to HTTP Event Collector (HEC) without passing HEC Token in Authorization Header

[nmadhok]

Wanting to forward all raw events from Client/Application to a specified HTTP Event Collector (HEC) endpoint/URL for on-prem/self-hosted Splunk environment but Client/Application only allows for a URL to be specified and does not allow specifying the HEC token in authorization header for HTTP Authentication or including it in basic authentication request. 

How can the raw events be ingested into on-prem/self hosted Splunk using HTTP Event Collector (HEC) input without an Authorization header? Is it possible to specify the HEC token as a query string/parameter in the URL itself?

[nmadhok · Accepted solution]

Query string authentication can be enabled on a per-token basis.

1. On the Splunk server, edit the file at $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf . Tokens are listed by name in this file, in the form http://<token_name> . 
2. Within the stanza for each token that needs to enable query string authentication, add the following setting (or change the existing setting, if applicable): 

   allowQueryStringAuth = true

3. Save and close the inputs.conf file and restart Splunk service to reload configuration.

For Splunk Cloud, you must open a Splunk Support ticket to set allowQueryStringAuth to true. Support for a toggle in Splunk Web for this setting is planned for a future release.

HEC token can then be specified as a query string in the URL in the format:

?token=<hec_token>

For example:

curl -k "https://my-splunk-hec.example.com:8088/services/collector/raw?token=91dfd4e5-da4f-4861-89dd-dcdec19067fb&channel=8cf7407d-fa98-4d97-9b7b-5f5902aa7744&sourcetype=mydata" -d '1, 2, 3... Hello, world!'

[Matheus_Vieira]

This is awesome. Thanks much for sharing it!