Security

Creating HEC token for clustered environment

payl_chdhry
Explorer

Hi All,

 

We have a clustered environment where we want to enable and add HEC on Heavy Forwarder but I am not able to figure out how to do this via deployment server. I need the exact steps you can do from server (not web) and without login into HF, should only login to DS. I would prefer it to be done just by updating configuration files and not via web as we are also looking to automate this in future. The basic issue i have a how to generate the token itself, is this something we can give on our own or do we need to generate each time? This page does not tell how i can generate a token value: https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/UseHECusingconffiles

I addition we are not going to use the default httinputs app but create new app for each index if required, like splunk_httpinput_<appname>

 

Please help!

Thanks,

 

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

The token is generated by uuidgen or something similar. Basically you could use any token which you want, but maybe it's better to use that UUID format. You can use e.g. in linux uuidgen or use some other tools which generate UUIDs. Just add this to inputs.conf file and then deploy it with your own apps.

One remarks which we have found with MC, when you are monitoring HEC with several HF, is that MC warns that you have several same tokens installed.

r. Ismo

 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

The token is generated by uuidgen or something similar. Basically you could use any token which you want, but maybe it's better to use that UUID format. You can use e.g. in linux uuidgen or use some other tools which generate UUIDs. Just add this to inputs.conf file and then deploy it with your own apps.

One remarks which we have found with MC, when you are monitoring HEC with several HF, is that MC warns that you have several same tokens installed.

r. Ismo

 

payl_chdhry
Explorer

Thanks @isoutamo Let me try this once.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...