topic Re: Splunk 6 indexing in Installation

Splunk 6 indexing

kmattern — Wed, 05 Mar 2014 16:17:29 GMT

I just upgraded to Splunk 6.0.2. Why did it override all of my indexes. In 5.0.4 I specified a separate index for each of my major sourcetypes. But Splunk 6 blithely decided to dump everything into main. What gives?

Re: Splunk 6 indexing

bosburn_splunk — Wed, 05 Mar 2014 16:33:06 GMT

Did you put your configuration files in the default directory vs local?

Re: Splunk 6 indexing

kmattern — Wed, 05 Mar 2014 16:37:06 GMT

I always use local. When I set up 5.0.4 six months ago I defined all my indexes then. If I search the original indexes for events prior to the upgrade, everything is there.

Re: Splunk 6 indexing

bosburn_splunk — Wed, 05 Mar 2014 17:05:33 GMT

It really shouldn't of overrided the configurations if you have things in local.

Do you have enterprise support? If so, can you get a ticket opened up and let me know the ticket number..

Re: Splunk 6 indexing

kmattern — Thu, 06 Mar 2014 15:50:22 GMT

Sigh... The forwarder was sending the log to multiple indexers and specifying the index as main. I'll have to find another way to get the data consumed.