Can you help me replace the Index for an existing HTTP event collector token?

[ahmed23]

As I want to use the same HTTP event collector (HEC) token, can i add the new index=X and remove old index=Y? But, I don't want to lose the events on old index=Y. So, if i do that, the events on Index=Y are still searchable ??

Or should i keep both indexes and change the default index=X ??

Or any specific procedure to do that?

[martin_mueller · Accepted solution]

Changing the HEC input configuration will not alter already-indexed data. Just make sure you keep both indexes configured and you'll be able to search both - even if you were to some day delete the HEC token.