Next, you will generate an HEC authentication token. The HEC token will ensure no unknown applications have their data indexed if it arrives at your Splunk server on the assigned port. The HEC authentication token is sent in the HTTP header of the incoming request to Splunk. Without this token, the Splunk response would typically indicate a status code 401 (unauthorized error).
The HEC token will also enable you to override the source tag of all incoming data. This makes it easy to differentiate data streams later, based on where the data is coming from. It is best practice to create a separate token for each application. If something goes wrong with one application, say it starts flooding your Splunk ...
