Which Splunk versions require a service restart for HEC token revocation to take effect?

Testing HEC token revocation behavior across Splunk versions

When validating an integration against a non-production Splunk instance, teams often create dedicated HEC tokens, send test events, then revoke the token to confirm rejection. The documentation indicates that revocation takes effect only after the next authentication handshake, creating a window where events may still be accepted. This latency varies by release, and older versions reportedly require a full service restart before the revocation is honored.

There is no supported REST endpoint to query the current revocation state of a token; administrators must inspect the splunkd index for evidence of token usage or rejection. If that index is disabled or aggressively rotated, the audit trail disappears, making it difficult to verify that revocation has propagated.

Understanding exactly which Splunk Enterprise versions enforce immediate rejection versus which demand a restart is essential for designing reliable integration tests that do not depend on production credentials.

• Which Splunk Enterprise releases require a service restart for HEC token revocation to become effective?
• Can the revocation latency be observed reliably through the splunkd index without enabling additional debug logging?
• Does enabling TLS 1.3 on the HEC endpoint change the handshake behavior that governs revocation enforcement?