Question on HEC configuration

km1986 · ‎11-19-2020

Hello,

I have data inputs configured with HEC coming in to index=A and source=http:sourcename1.

I now have logs of similar type which I want to come into the same index (i.e index=A) and with the same source i.e. http:sourcename1, but which would require me to setup a new HEC connection with a new token.

Please let me know if this is possible? Thanks.

richgalloway · ‎11-19-2020

Yes, it is possible. Set up the new token the same way you set up the old one.

---
If this reply helps you, Karma would be appreciated.

Question on HEC configuration

HTTP Event Collector

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

Index This | What has many keys but can’t unlock a door?

Join the Conversation

Question on HEC configuration

HTTP Event Collector

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

Index This | What has many keys but can’t unlock a door?