Splunk Enterprise

Unable to send data to multiple indexes using raw endpoint in Splunk HEC

ramganeshn
Explorer

We are trying to send data to raw endpoint via Splunk HEC. When we do so, the data is always sent only to the default index and is not sent to the other indexes. Can someone guide us on how to have this resolved? Any idea? The scenario is as below:

[http://LGS-HEC-PROD]
disabled = 0
index = index_one
indexes = index_one,index_two,index_three,index_four,index_five
token = <OUR_HEC_TOKEN>

We are trying to send data from splunk-library-javalogging and to the raw endpoint of our Splunk HEC. So, whenever we send changing the index from index_one to index_two or index_three, the events are still written to the index_one(Which is the default index index = index_one). This is not happening with the event endpoint and happens only with the raw endpoint. Is this a limitation with the Splunk HEC or are we missing something on this. Please advise.

lbruhns
Explorer

info on this seems sparse i have a similar challenge with k8s coing over hec, i'd like to be able to have more htan one index per token but how does it route?

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...