We are generating HEC tokens on a deployment server and pushing them out to the HECs.
HEC tokens are disabled by default on the HECs and the deployment server and need to be enabled in global settings.
What I've done so far is:
-authorize.conf, this is for user tokens and isn't working for HEC tokens
-the CLI command for token enable isn't working because it's not enabled globally
-inputs.conf has [http] disabled=0
The only thing that has worked is enabling it via the UI. Is there a way to enable these over CLI?
Solved. Splunk did not take conf file enablement on creation. It must be modified afterwards.
Solved. Splunk did not take conf file enablement on creation. It must be modified afterwards.