Hi,
I have configured a HEC Token with two different indexes (at my work we have lots of apps that are being used by two countries, for example, index APP_C1 and index APP_C2). The thing is that I want to have one token per app and configure the scripts so it can send data to the respective country index independently.
So, my HEC is configured with those two indexes, the thing is that it only works for the first one. I've tried with other HECs configured with more indexes and the problem happens the same way.
I'm using the NPM package called "splunk-logging". And the error I get is
"Response from Splunk { text: 'Incorrect index', code: 7, 'invalid-event-number': 1 } APP_C2"
I've been searching for a while with no luck. Please help!
... View more