Getting Data In

Can you help me replace the Index for an existing HTTP event collector token?

ahmed23
New Member

As I want to use the same HTTP event collector (HEC) token, can i add the new index=X and remove old index=Y? But, I don't want to lose the events on old index=Y. So, if i do that, the events on Index=Y are still searchable ??

Or should i keep both indexes and change the default index=X ??

Or any specific procedure to do that?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Changing the HEC input configuration will not alter already-indexed data. Just make sure you keep both indexes configured and you'll be able to search both - even if you were to some day delete the HEC token.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Changing the HEC input configuration will not alter already-indexed data. Just make sure you keep both indexes configured and you'll be able to search both - even if you were to some day delete the HEC token.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...