Getting Data In

Can you help me replace the Index for an existing HTTP event collector token?

ahmed23
New Member

As I want to use the same HTTP event collector (HEC) token, can i add the new index=X and remove old index=Y? But, I don't want to lose the events on old index=Y. So, if i do that, the events on Index=Y are still searchable ??

Or should i keep both indexes and change the default index=X ??

Or any specific procedure to do that?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Changing the HEC input configuration will not alter already-indexed data. Just make sure you keep both indexes configured and you'll be able to search both - even if you were to some day delete the HEC token.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Changing the HEC input configuration will not alter already-indexed data. Just make sure you keep both indexes configured and you'll be able to search both - even if you were to some day delete the HEC token.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...