https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-replace-the-Index-for-an-existing-HTTP-event/m-p/393893#M70319 <P>Changing the HEC input configuration will not alter already-indexed data. Just make sure you keep both indexes configured and you'll be able to search both - even if you were to some day delete the HEC token.</P> Tue, 08 Jan 2019 23:55:54 GMT martin_mueller 2019-01-08T23:55:54Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-replace-the-Index-for-an-existing-HTTP-event/m-p/393892#M70318 <P>As I want to use the same HTTP event collector (HEC) token, can i add the new index=X and remove old index=Y? But, I don't want to lose the events on old index=Y. So, if i do that, the events on Index=Y are still searchable ??</P> <P>Or should i keep both indexes and change the default index=X ??</P> <P>Or any specific procedure to do that?</P> Tue, 08 Jan 2019 21:37:24 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-replace-the-Index-for-an-existing-HTTP-event/m-p/393892#M70318 ahmed23 2019-01-08T21:37:24Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-replace-the-Index-for-an-existing-HTTP-event/m-p/393893#M70319 <P>Changing the HEC input configuration will not alter already-indexed data. Just make sure you keep both indexes configured and you'll be able to search both - even if you were to some day delete the HEC token.</P> Tue, 08 Jan 2019 23:55:54 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-replace-the-Index-for-an-existing-HTTP-event/m-p/393893#M70319 martin_mueller 2019-01-08T23:55:54Z