topic Re: How to move index defination from one app to another app ? in All Apps and Add-ons

How to move index defination from one app to another app ?

vikas_gopal — Sun, 05 Nov 2017 05:08:28 GMT

Experts,

I know this is very simple but somehow I am not able to achieve it . I have created one index in search app and now I want to move it to another app . This is what I have done so far

1) Stop splunk
2) cut the stenza from /splunkhome/etc/app/search/indexes.conf

[windows]
coldPath = $SPLUNK_DB\windows\colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB\windows\db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB\windows\thaweddb

3) paste this under /splunkhome/etc/apps/win/indexes.conf
4) start splunk

Now When I am checking the index in the setting windows index is gone . Not sure what is missing here ?

Reagrds
VG

Re: How to move index defination from one app to another app ?

vikas_gopal — Sun, 05 Nov 2017 05:18:29 GMT

on Splunk Web I am getting below error as well
Received event for unconfigured/disabled/deleted index=windows with source="source::disk" host="host::DESKTOP-CVGTF3S" sourcetype="sourcetype::WinHostMon". So far received events from 1 missing index(es).

Re: How to move index defination from one app to another app ?

jkat54 — Sun, 05 Nov 2017 14:30:02 GMT

Is this a clustered environment? If so you should be modifying indexes.conf on cluster master in an app under splunkhome/etc/master-apps

Re: How to move index defination from one app to another app ?

jkat54 — Sun, 05 Nov 2017 14:31:00 GMT

If this is just for your search head, then the error is from not having the index defined on your indexers.

Re: How to move index defination from one app to another app ?

vikas_gopal — Sun, 05 Nov 2017 15:13:00 GMT

Neither it is a cluster environment nor my indexer and search head are on different machine .It is a dev machine so all the components are on same machine that is search head and indexer.

Re: How to move index defination from one app to another app ?

vikas_gopal — Sun, 05 Nov 2017 15:20:06 GMT

for alternate i can create new app then create new index within this app. But I want to test if i already have index in search app and later I want to move it to my newly created app then I am facing an issue . Saw many answers on the same topic and I followed the instructions but no success .
Something like this
https://answers.splunk.com/answers/174843/how-to-move-an-index-to-another-app.html

Re: How to move index defination from one app to another app ?

jkat54 — Sun, 05 Nov 2017 15:27:18 GMT

It’s fine to put indexes.conf in any app so long as you restart after

Re: How to move index defination from one app to another app ?

MuS — Sun, 05 Nov 2017 19:41:19 GMT

Some things you can check:

Check the file permission of the new indexes.conf
run $SPLUNK_HOME/bin/splunk list index and see if your index is in the list
run $SPLUNK_HOME/bin/splunk btool indexes list <yourindexnamehere> to see if Splunk uses your config file
Check App / config file precedence, maybe your config is not applied

cheers, MuS

Re: How to move index defination from one app to another app ?

esix_splunk — Mon, 06 Nov 2017 03:48:10 GMT

Issue here is where you have your indexes.conf file actually located.

/splunkhome/etc/app/search/indexes.conf

This should actually be under /splunkhome/etc/apps/APPNAME/local/indexes.conf.

Most likely, you copied it out of that location on the search app, but the Win app didnt have a local directory, so this file ended up in the apps home directory. Move it and restart!

Re: How to move index defination from one app to another app ?

hardikJsheth — Tue, 29 Sep 2020 16:34:29 GMT

What permission did you set for this index? You need to provide it under $SPLUNK_HOME/etc/apps/search/metadata/local.meta or
$SPLUNK_HOME/etc/apps/search/metadata/default.meta

[indexes/cmx]
owner = admin
version = 6.5.0
modtime = 1487359650.296835000

Version and modtime can be ignored.

Re: How to move index defination from one app to another app ?

esix_splunk — Mon, 06 Nov 2017 06:25:09 GMT

This is not necessary for indexes.conf configurations.

Re: How to move index defination from one app to another app ?

mayurr98 — Mon, 06 Nov 2017 10:31:47 GMT

hey @vikas_gopal

Please follow the below steps to move index from one app to another app.

1) Stop Splunk
2) go to splunkhome/etc/app/search/indexes.conf (the directory where you saved your .conf file)
3) write mv indexes.conf /opt/splunk/etc//local/
4) check if the file is moved or not.
5) restart splunk

I hope this solves your problem.