diff --git a/components/monitoring/logging/base/configure-logging/configure-logforwarder.yaml b/components/monitoring/logging/base/configure-logging/configure-logforwarder.yaml
index d92fb040515..e79c3ca6c8d 100644
--- a/components/monitoring/logging/base/configure-logging/configure-logforwarder.yaml
+++ b/components/monitoring/logging/base/configure-logging/configure-logforwarder.yaml
@@ -19,13 +19,17 @@ spec:
       splunk:
         url: https://http-inputs-rhcorporate.splunkcloud.com
         authentication:
-          token: log-forwarder-splunk-rhtap-application-secret
+          token:
+              secretName: log-forwarder-splunk-rhtap-application-secret
+              key: hecToken
     - name: splunk-receiver-audit
       type: splunk
       splunk:
         url: https://http-inputs-rhcorporate.splunkcloud.com
         authentication:
-          token: log-forwarder-splunk-rhtap-audit-secret
+          token:
+              secretName: log-forwarder-splunk-rhtap-audit-secret
+              key: hecToken
   filters:
     - name: parse-json
       type: parse