https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41591#M370 <P>I am not sure what you mean by "when we move the machine all the history moves with it." Is that what you do now, or what you are trying to figure out how to do?</P> <P>Do you have multiple Splunk environments for DEV/QA/PROD? Do you have separate indexes for DEV/QA/PROD?</P> <P>Splunk tags are persistent within a Splunk environment, but they are not indexed. I guess the bottom line question is: what do you want to move between environments: log data, config data (like tags) or something else?</P> Tue, 21 May 2013 18:52:34 GMT lguinn2 2013-05-21T18:52:34Z https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41590#M369 <P>We will regularly move machines between environments (DEV/QA/PRD). We are currently using tags to assign a machine to an environment, but when we move the machine all the history moves with it. Is there a better way to do this instead of tags, or is there a way to persist a tag? I'm guessing I cannot persist a tag since my understanding is that they are meant to be transient...</P> Tue, 21 May 2013 17:09:21 GMT https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41590#M369 timrcase 2013-05-21T17:09:21Z https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41591#M370 <P>I am not sure what you mean by "when we move the machine all the history moves with it." Is that what you do now, or what you are trying to figure out how to do?</P> <P>Do you have multiple Splunk environments for DEV/QA/PROD? Do you have separate indexes for DEV/QA/PROD?</P> <P>Splunk tags are persistent within a Splunk environment, but they are not indexed. I guess the bottom line question is: what do you want to move between environments: log data, config data (like tags) or something else?</P> Tue, 21 May 2013 18:52:34 GMT https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41591#M370 lguinn2 2013-05-21T18:52:34Z https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41592#M371 <P>An example: server01 is part of our DEV application environment and tagged as such. Next month we decide to move server01 to our PRD application environment and update the tags in Splunk accordingly. The problem is, all the data that Splunk has indexed for server01 is now attributed to PRD.</P> <P>In traditional DW/BI this is handled via slowly changing dimensions, but I'm not aware of anything like that in Splunk.</P> Tue, 21 May 2013 18:59:02 GMT https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41592#M371 timrcase 2013-05-21T18:59:02Z https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41593#M372 <P>You could perhaps solve this using temporal (time-based) lookups, where you specify a time period and an environment for each server, and a new time period when the server's environment changes. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-based_fields_lookup">http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-based_fields_lookup</A></P> Tue, 21 May 2013 21:05:10 GMT https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41593#M372 Ayn 2013-05-21T21:05:10Z https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41594#M373 <P>That would be my solution as well. The lookup CSV could contain</P> <P><CODE>host,hostEnv,startDate<BR /> server01,PRD,21-Mar-2013 00:00<BR /> server01,QA,15-Mar-2013 02:00<BR /> server02,PRD,1-Jul-2010 00:00</CODE></P> <P>etc.</P> Tue, 21 May 2013 23:55:17 GMT https://community.splunk.com/t5/Knowledge-Management/Permanent-tag/m-p/41594#M373 lguinn2 2013-05-21T23:55:17Z