topic Re: How can I create a new index called "index_global" and point all these 5 indexes to this global index? in Splunk Enterprise

How can I create a new index called "index_global" and point all these 5 indexes to this global index?

im_bharath — Mon, 10 Oct 2022 13:45:49 GMT

Hello All,

We are currently getting data from an application into these 5 indexes(index1, index2, index3, index4, index5.. ) from different locations around the world. And I want to try and create a new index called "index_global" and point all these 5 indexes to this global index so that all the data can be available under a single index.

Hope this makes sense.

I would really like to understand, how i can achieve this. Any help on this would be really appreciated.

Thanks and cheers.

Re: How can I create a new index called "index_global" and point all these 5 indexes to this global index?

richgalloway — Tue, 11 Oct 2022 00:01:21 GMT

It's not clear what your end goal is. What do you mean by "point these 5 indexes to this global index"?

It's easy to create the "index_global" index. it's also fairly easy to have the inputs send their data to index_global instead of index_n. That will not move the data that is already in index_n, however. Nor can index_global be an alias for another (5) index(es). The closest you can get is a macro, perhaps called "index_global" this is defined as

index IN (index_1 index_2 index_3 index_4 index_5)

and is invoked as

`index_global` sourcetype=foo ...

Re: How can I create a new index called "index_global" and point all these 5 indexes to this global index?

im_bharath — Tue, 11 Oct 2022 12:06:20 GMT

Hey @richgalloway thank you for the response.

So when i say "point these indexes 5 indexes to global index", I want the application to send the data in to this newly created "index_global" instead of these 5 indexes.

Re: How can I create a new index called "index_global" and point all these 5 indexes to this global index?

richgalloway — Tue, 11 Oct 2022 12:20:00 GMT

Change your inputs.conf files to replace "index_n" with "index_global".

Re: How can I create a new index called "index_global" and point all these 5 indexes to this global index?

im_bharath — Tue, 11 Oct 2022 12:23:34 GMT

Thank you very much @richgalloway