How to rename a HEC Data Input token

[yuelu]

I created a HEC token call test_app initially for accepting log data from a test app.  That app has morphed into a prod app.  I would like to change the HEC token name to prod_app.  How do I do that?  Thanks.

[FrankVl]

If it is an on-prem splunk instance where you have configured that HEC token, you can edit it in the respective inputs.conf file.

If you're on Splunk Cloud or for some other reason do not have access to the configuration file, you'd probably have to create a new token with the new name and just update the token used at the source side. As there doesn't seem to be an option to rename a HEC input on the GUI or create a new HEC input with a specific token value.