https://community.splunk.com/t5/Getting-Data-In/implications-of-changing-the-configurations-of-an-indexed-file/m-p/583481#M102796 <P>Inputs don't "touch" indexes at all. The only dependency is that after processing the input, when the data is sent further down the pipeline for parsing/forwarding/indexing it can have the metadata field specifying destination index set. That's all.</P><P>So you can freely add, change, remove inputs and nothing will hapen to the indexes themselves and data already indexed.</P><P>I don't know what you mean by "add fields to the stanza of indexed file".</P><P>If you mean field extractions then no, yiu don't have to touch indexes either if you're defining new field extractions. In fact newly defined search-time extractions will work on already indexed data.</P><P>And you don't define extractions per index. You define them per sourcetype, source or host pattern. It's not a RDBMS. <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Thu, 03 Feb 2022 07:09:35 GMT PickleRick 2022-02-03T07:09:35Z https://community.splunk.com/t5/Getting-Data-In/implications-of-changing-the-configurations-of-an-indexed-file/m-p/583469#M102795 <P>Hi splunk community! Im new to splunk here so im not very clear on the consequences of updating indexes</P><P>1. For example, if <EM>index1</EM> indexes from <EM>file1</EM>, but if in the future i want to change it to index from <EM>file2</EM> instead, will there be any implications if i just update the stanza in input.conf file to direct to <EM>file2&nbsp; </EM>instead of <EM>file1</EM>? or do i need to delete the current index and create a new one and then direct to <EM>file2</EM>?</P><P>2. If i want to add more fields to the stanza of the indexed file, will i need to recreate the index? or can i just add the field to the stanza</P><P>thank you in advance!</P> Thu, 03 Feb 2022 03:47:06 GMT https://community.splunk.com/t5/Getting-Data-In/implications-of-changing-the-configurations-of-an-indexed-file/m-p/583469#M102795 sophiacyh 2022-02-03T03:47:06Z https://community.splunk.com/t5/Getting-Data-In/implications-of-changing-the-configurations-of-an-indexed-file/m-p/583481#M102796 <P>Inputs don't "touch" indexes at all. The only dependency is that after processing the input, when the data is sent further down the pipeline for parsing/forwarding/indexing it can have the metadata field specifying destination index set. That's all.</P><P>So you can freely add, change, remove inputs and nothing will hapen to the indexes themselves and data already indexed.</P><P>I don't know what you mean by "add fields to the stanza of indexed file".</P><P>If you mean field extractions then no, yiu don't have to touch indexes either if you're defining new field extractions. In fact newly defined search-time extractions will work on already indexed data.</P><P>And you don't define extractions per index. You define them per sourcetype, source or host pattern. It's not a RDBMS. <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Thu, 03 Feb 2022 07:09:35 GMT https://community.splunk.com/t5/Getting-Data-In/implications-of-changing-the-configurations-of-an-indexed-file/m-p/583481#M102796 PickleRick 2022-02-03T07:09:35Z