From d504282464d5b7d03620f1e13fdec2482b4a2db4 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Wed, 5 Jun 2024 15:36:39 +0900 Subject: [PATCH] in_splunk: Address comments Signed-off-by: Hiroshi Hatake Co-authored-by: Pat --- pipeline/inputs/splunk.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pipeline/inputs/splunk.md b/pipeline/inputs/splunk.md index 53252dd18..bc85adbad 100644 --- a/pipeline/inputs/splunk.md +++ b/pipeline/inputs/splunk.md @@ -12,9 +12,9 @@ The **splunk** input plugin handles [Splunk HTTP HEC](https://docs.splunk.com/Do | buffer_max_size | Specify the maximum buffer size in KB to receive a JSON message. | 4M | | buffer_chunk_size | This sets the chunk size for incoming incoming JSON messages. These chunks are then stored/managed in the space available by buffer_max_size. | 512K | | successful_response_code | It allows to set successful response code. `200`, `201` and `204` are supported. | 201 | -| splunk\_token | Add an Splunk token for HTTP HEC. If specified multiple tokens with commas, it will be divided into each of tokens and they will be used for authentication of HTTP HEC. | | -| store\_token\_to\_metadata | Store Splunk HEC tokens to matadata. If set as false, they will be stored into records. | true | -| splunk\_token\_key | Add a key for storing Splunk token for HTTP HEC. This is effective when `store_token_to_metadata` as false. | @splunk_token | +| splunk\_token | Specify a Splunk token for HTTP HEC authentication. If multiple tokens are specified (with commas and no spaces), usage will be divided across each of the tokens. | | +| store\_token\_in\_metadata | Store Splunk HEC tokens as a part of metadata. If set as false, they will be stored as a part of records. | true | +| splunk\_token\_key | Use the specified key for storing the Splunk token for HTTP HEC. This is effective when `store_token_in_metadata` as false. | @splunk_token | ## Getting Started