Index changes after Device IP changed and hardware refreshed

splunk_newbie3 — Thu, 19 Oct 2023 04:27:58 GMT

Hi Community,

One of the log source (e.g. index=my_index) at my company's splunk became inter=main. After multiple investigation, i found that Infrastructure Team has refreshed the device to a new hardware due to product EOL (same brand, same product, e.g. Palo Alto 3020 to PA3220). Also, the device IP is changed.

Thus, i have modified the monitoring path at inputs.conf in Add-on and distribute to HF by deployment server.

Here is the example for what i modified:

[monitor:///siem/data/syslog/192.168.1.101/*] #original ip was 192.168.1.100

disabled = false

index = my_index

sourcetype = my:sourcetype

host_segment = 4

After such changes, i tried to verify the result on HF, the inputs.conf was successfully update to the new version.

However, the logs remain to index=main when searching on Search Head after the changes i did above.

Anyone know if any other thing i need to modify? Or else there are other root cause that making the logs fall under wrong index apart from the ip changes?

Re: Index changes after Device IP changed and hardware refreshed

isoutamo — Thu, 19 Oct 2023 06:16:40 GMT

your changes apply only to new events not to those which are already indexed.

r. Ismo

topic Index changes after Device IP changed and hardware refreshed in Getting Data In

Index changes after Device IP changed and hardware refreshed

Re: Index changes after Device IP changed and hardware refreshed