Does anyone know if it's possible to rename an HEC or do you have to create a new one and update the token everywhere? Seems like just renaming it should be an option under edit, but not seeing anything.
If you have access to the CLI, you should be able to change the name by editing the appropriate inputs.conf file. Then restart Splunk or push the bundle.
And if/when you have several nodes after HEC LB VIP then you must do this on all nodes (HF or/and indexers).