How must HEC settings be edited in Splunk Cloud?

HEC, or HTTP Event Collector, settings in Splunk Cloud must be edited through the Search Head Web interface. This is because Splunk Cloud is a managed service, and modifications to settings, including HEC configurations, are typically restricted to the web-based interface provided by Splunk.

The Search Head Web interface offers a user-friendly way to configure various settings without needing direct access to underlying components, ensuring that changes made are consistent with the cloud architecture and do not disrupt the managed service environment.

Editing HEC settings through the CLI, on the indexers, or on a deployment server is not applicable in Splunk Cloud due to the managed nature of the service. Adjustments to configurations like HEC must adhere to the practices that safeguard the integrity and functionality of the cloud platform, which is why utilizing the Search Head Web interface is the designated method for these modifications.