All Apps and Add-ons

HEC token for cloud and Enterprise both

splunkdivya
Explorer

Hi Splunkers,

I need to send data through HEC token to on-prem as well as Cloud splunk instance.

Please help me with some pointers.

Thanks in advance

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Please check this link: https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector. It contains all the steps to create token for both Splunk Enterprise and Splunk cloud.

0 Karma

splunkdivya
Explorer

Hey @manjunathmethi, I need same single token for sending data simultaneously on the two instances.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

@splunkdivya On Splunk cloud you can Enable HTTP Event Collector and create an Event Collector token. You can use same collection token ID in outputs.conf in app 'splunk_httpinput' ($SPLUNK_HOME/etc/apps/splunk_httpinput/local/) on on-prem splunk.

# Default settings
[http]
disabled = 0
port = 8088

[http://test_data]
description = HTTP event collector token for collecting data.
disabled = 0
index = main
indexes = main
sourcetype = test
token = <TOKEN>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...