Edit CrowdStrike data input

Edit a CrowdStrike input to update configuration parameters such as AWS credentials, SQS queue settings, or the destination index.

You can edit a CrowdStrike input to update configuration parameters such as AWS credentials, SQS queue settings, or the destination index.

  1. Log into Splunk Cloud and select Data Manager.
  2. In the Ingest inputs tab, select the CrowdStrike data input that you want to update.
  3. On the details section, select Edit.

    The input configuration form opens, displaying the current parameter values.

  4. Modify the parameters as needed:
    • Update AWS credentials if needed
    • Change the SQS queue if your data source has changed
    • Adjust visibility timeout or notification cutoff time
    • Select a different destination index
    Note: You can edit an input even when its deployment status is failed. This allows you to correct configuration issues such as invalid credentials.
  5. Save the updated configuration.

    The system validates the new parameters and updates the input. If AWS credentials were changed, the deployment status will reflect the new validation results.

Monitor the deployment status to verify the changes were applied successfully.