https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493084#M84277 <P>Thanks for the response. Yes, the new index exist on all the indexers and i have restarted the forwarder. checked if the index name has changed on the server by the application team and it has the new index in the inputs.conf but still it is ingesting to the old index.</P> Fri, 04 Oct 2019 15:28:43 GMT sathwikr076 2019-10-04T15:28:43Z https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493080#M84273 <P>I have changed the index name for a log ingestion to a new one but the logs are still ingesting to the old index. I cannot understand why the logs are not ingesting to new index. Please let me know if anyone have any idea.</P> <P>Thanks.</P> Fri, 04 Oct 2019 14:54:56 GMT https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493080#M84273 sathwikr076 2019-10-04T14:54:56Z https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493081#M84274 <P>Hi sathwikr076,<BR /> how do you changed destination index? </P> <UL> <LI>in inputs.conf on Universal Forwarders,</LI> <LI>in overriding on Indexers?</LI> </UL> <P>If on UFs, after update, did you restarted Splunk on UFs?<BR /> If on Indexers, after update, did you restarted Splunk on Indexers? have you in the middle any Heavy Forwarders?</P> <P>Bye.<BR /> Giuseppe</P> Fri, 04 Oct 2019 15:08:00 GMT https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493081#M84274 gcusello 2019-10-04T15:08:00Z https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493082#M84275 <P>i have changed on UF and restarted the service through deployment server remotely as i do not have access to the server. i checked the internal logs and i can see <BR /> <STRONG>Metrics - group=per_index_thruput, series="new_index", kbps=0.22774524335479657, eps=0.19367014189230036, kb=7.0556640625, ev=6, avg_age=9110.833333333334, max_age=54545</STRONG> but still it is ingesting to the old index. i just asked the application team to restart the forwarder directly on the server.</P> Wed, 30 Sep 2020 02:23:27 GMT https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493082#M84275 sathwikr076 2020-09-30T02:23:27Z https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493083#M84276 <P>Greetings @sathwikr076,</P> <OL> <LI>Does the index exist on the indexer that the data is being forwarded to?</LI> <LI>Did you restart the Splunk forwarder service on the machine that is monitoring the log?</LI> </OL> <P>Cheers,<BR /> Jacob</P> Fri, 04 Oct 2019 15:14:33 GMT https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493083#M84276 jacobpevans 2019-10-04T15:14:33Z https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493084#M84277 <P>Thanks for the response. Yes, the new index exist on all the indexers and i have restarted the forwarder. checked if the index name has changed on the server by the application team and it has the new index in the inputs.conf but still it is ingesting to the old index.</P> Fri, 04 Oct 2019 15:28:43 GMT https://community.splunk.com/t5/Getting-Data-In/replaced-with-new-index-with-old-one-in-inputs-conf/m-p/493084#M84277 sathwikr076 2019-10-04T15:28:43Z