Knowledge Management

How to rename a HEC Data Input token


I created a HEC token call test_app initially for accepting log data from a test app.  That app has morphed into a prod app.  I would like to change the HEC token name to prod_app.  How do I do that?  Thanks.

Labels (1)
0 Karma

Ultra Champion

If it is an on-prem splunk instance where you have configured that HEC token, you can edit it in the respective inputs.conf file.

If you're on Splunk Cloud or for some other reason do not have access to the configuration file, you'd probably have to create a new token with the new name and just update the token used at the source side. As there doesn't seem to be an option to rename a HEC input on the GUI or create a new HEC input with a specific token value.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...