Creating HEC token for clustered environment

[payl_chdhry]

Hi All,

We have a clustered environment where we want to enable and add HEC on Heavy Forwarder but I am not able to figure out how to do this via deployment server. I need the exact steps you can do from server (not web) and without login into HF, should only login to DS. I would prefer it to be done just by updating configuration files and not via web as we are also looking to automate this in future. The basic issue i have a how to generate the token itself, is this something we can give on our own or do we need to generate each time? This page does not tell how i can generate a token value: https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/UseHECusingconffiles

I addition we are not going to use the default httinputs app but create new app for each index if required, like splunk_httpinput_<appname>

Please help!

Thanks,

[isoutamo · Accepted solution]

Hi

The token is generated by uuidgen or something similar. Basically you could use any token which you want, but maybe it's better to use that UUID format. You can use e.g. in linux uuidgen or use some other tools which generate UUIDs. Just add this to inputs.conf file and then deploy it with your own apps.

One remarks which we have found with MC, when you are monitoring HEC with several HF, is that MC warns that you have several same tokens installed.

r. Ismo

[payl_chdhry]

Thanks @isoutamo Let me try this once.