Create a Splunk HTTP Event Collector token

To receive HTTP post messages in Splunk, we need to create a Splunk HTTP Collector token.

To create an index for this token see Create a Splunk index

1. In the Settings menu select Data Inputs
   
2. Select the HTTP Event Collector link
   
3. Click the New Token button
   
4. Enter a name and description for the token and click the Next button
   
5. Select the index to store the events in, set it as the default index, and click the Review button
   
6. Click the Submit button to create the token
   
7. The confirmation screen shows the token. You will be able to see it again on the token list page. Click the Start Searching button to see the search statement to see the events collected by this token.
   
8. You can always search for the events with

   source="http:MY_INPUT" (index="MY_INDEX")

   

9. The HTTP Event Collector token list shows the token.