Getting Data In

Splunk HEC on heavy forwarder but limiting to indexes

jcrosby21
Path Finder

I am sending information to splunk via an HTTP Event collector and specifying the index in the body of the HTTP POST.


I have an HTTP Event collector on a heavy forwarder per this documentation:
https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/ScaleHTTPEventCollector

However, I'd like to be able to define a token to a limited set of indexes per this documentation.  So the consumer can supply an index but cannot supply ANY index in their payload.  This appears to be the "indexes" property:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/Data/UseHECusingconffiles

When I use the GUI to create a token I only see indexes on the heavy forwarder to limit to, it does not show me the indexes actually on my clustered indexers.  When I manually edit the configuration for a token in the .conf file to have the index I want to limit to I receive an "Incorrect Index" error.

Is it possible to have my HEC on a heavy forwarder but limit a token to indexes defined on my indexer cluster?

Labels (2)
0 Karma
1 Solution

rupkumar4sec
Path Finder

We have a similar setup and it works completely fine. Indexes are defined in Indexer cluster but not defined in heavy forwarder, and receiving data to those indexes using HEC(configured on HF).  Can you share the error you are getting?

View solution in original post

rupkumar4sec
Path Finder

We have a similar setup and it works completely fine. Indexes are defined in Indexer cluster but not defined in heavy forwarder, and receiving data to those indexes using HEC(configured on HF).  Can you share the error you are getting?

jcrosby21
Path Finder
and after writing up a whole thing laying out all the pieces I decided to reboot my forwarder just in case and now it works for me.
 
It would appear that while SOME things get picked up without rebooting services when working with the HEC some things probably need splunk to restart.
 
Thanks for the validation!
Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...