Can you distribute an Http Event Collector (HEC) without restarting?

[freaklin]

Hi,

I use to share my HEC tokens with the index cluster via deployment server. When I create the new token into Cluster Master, It doesn't require me a restart. But, when I share the inputs.conf via deployment-server and this conf goes to the indexer(or forwarder), It requires a restart in order to enable the new tokens.

Is there a way to push the tokens avoiding indexer(or forwarder) restart?

[iamarkaprabha]

Hi ,

I would suggest you to create a serverclass and put the http_input app over there in the Deployment server,
Then reload the serverclass from the DS. You don't need to restart splunk over there anymore