Getting Data In

Can you help me replace the Index for an existing HTTP event collector token?

ahmed23
New Member

As I want to use the same HTTP event collector (HEC) token, can i add the new index=X and remove old index=Y? But, I don't want to lose the events on old index=Y. So, if i do that, the events on Index=Y are still searchable ??

Or should i keep both indexes and change the default index=X ??

Or any specific procedure to do that?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Changing the HEC input configuration will not alter already-indexed data. Just make sure you keep both indexes configured and you'll be able to search both - even if you were to some day delete the HEC token.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Changing the HEC input configuration will not alter already-indexed data. Just make sure you keep both indexes configured and you'll be able to search both - even if you were to some day delete the HEC token.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...