Getting Data In

Splunk HEC on heavy forwarder but limiting to indexes

jcrosby21
Path Finder

I am sending information to splunk via an HTTP Event collector and specifying the index in the body of the HTTP POST.


I have an HTTP Event collector on a heavy forwarder per this documentation:
https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/ScaleHTTPEventCollector

However, I'd like to be able to define a token to a limited set of indexes per this documentation.  So the consumer can supply an index but cannot supply ANY index in their payload.  This appears to be the "indexes" property:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/Data/UseHECusingconffiles

When I use the GUI to create a token I only see indexes on the heavy forwarder to limit to, it does not show me the indexes actually on my clustered indexers.  When I manually edit the configuration for a token in the .conf file to have the index I want to limit to I receive an "Incorrect Index" error.

Is it possible to have my HEC on a heavy forwarder but limit a token to indexes defined on my indexer cluster?

Labels (2)
0 Karma
1 Solution

rupkumar4sec
Path Finder

We have a similar setup and it works completely fine. Indexes are defined in Indexer cluster but not defined in heavy forwarder, and receiving data to those indexes using HEC(configured on HF).  Can you share the error you are getting?

View solution in original post

rupkumar4sec
Path Finder

We have a similar setup and it works completely fine. Indexes are defined in Indexer cluster but not defined in heavy forwarder, and receiving data to those indexes using HEC(configured on HF).  Can you share the error you are getting?

jcrosby21
Path Finder
and after writing up a whole thing laying out all the pieces I decided to reboot my forwarder just in case and now it works for me.
 
It would appear that while SOME things get picked up without rebooting services when working with the HEC some things probably need splunk to restart.
 
Thanks for the validation!
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...