Solution : index renaming not working when using _TCP_ROUTING

splunkreal — Wed, 13 Nov 2024 13:09:21 GMT

Hello, if you are using _TCP_ROUTING and index rename on target platform, logs may go to "last chance index"

Re: Solution : index renaming not working when using _TCP_ROUTING

splunkreal — Wed, 13 Nov 2024 13:10:44 GMT

In this case review inputs.conf sourcetype and change it if you use default pretrained :

https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Listofpretrainedsourcetypes

"The source types marked with an asterisk ( * ) use the INDEXED_EXTRACTIONS attribute, which sets other attributes in props.conf to specific defaults and requires special handling to forward to another Splunk platform instance. See Forward fields extracted from structured data files."

topic Solution : index renaming not working when using _TCP_ROUTING in Getting Data In

Solution : index renaming not working when using _TCP_ROUTING

Re: Solution : index renaming not working when using _TCP_ROUTING