Is it possible to rename a HEC under Data Inputs » HTTP Event Collector ?

[mark-jones]

Does anyone know if it's possible to rename an HEC or do you have to create a new one and update the token everywhere?  Seems like just renaming it should be an option under edit, but not seeing anything.

Thanks,

markjones_0-1663689574578.png

[richgalloway]

If you have access to the CLI, you should be able to change the name by editing the appropriate inputs.conf file.  Then restart Splunk or push the bundle.

[isoutamo]

And if/when you have several nodes after HEC LB VIP then you must do this on all nodes (HF or/and indexers).