topic Re: How to rename an index or move everything we have in the main index into another index? in Splunk Search

How to rename an index or move everything we have in the main index into another index?

ralphw_SAIC — Mon, 14 Sep 2015 15:28:30 GMT

Splunk 6.2.3 on RHEL6. We are growing and I would like to have some consistency in our index naming convention. So, I would like to move everything we have in MAIN into another index.

Is it as easy as cp -rp $SPLUNK_DB/* /foo/bar/ and changing the incoming feeds to point to the new index?

Thanks,

Re: How to rename an index or move everything we have in the main index into another index?

somesoni2 — Mon, 14 Sep 2015 18:01:55 GMT

Almost correct, with additional step to stop the splunk before and start after index data copy. See detailed steps here

http://answers.splunk.com/answers/5479/how-to-rename-an-index.html

Re: How to rename an index or move everything we have in the main index into another index?

ralphw_SAIC — Tue, 15 Sep 2015 18:04:26 GMT

Tried the above link and logs were still going to main. Only the local splunk server was sending anything to the new index. I updated inputs.conf with "index = NEW_INDEX" before I started splunk back up.

Any ideas on why nothing external was going to the new index? We are using the Universal Forwarder, if that helps any, on our clients.

Re: How to rename an index or move everything we have in the main index into another index?

rphillips_splk — Tue, 15 Sep 2015 18:12:32 GMT

did you update your UF inputs.conf monitor stanzas as well to include the index= NEW_INDEX and restart?

Re: How to rename an index or move everything we have in the main index into another index?

ralphw_SAIC — Tue, 15 Sep 2015 18:29:39 GMT

Sorry to sound like an id10t, but what do you mean by "UF"?

Also, I only updated inputs.conf on the server. At least that is how I read it. Do I also need to update it on the clients?

Re: How to rename an index or move everything we have in the main index into another index?

rphillips_splk — Tue, 15 Sep 2015 18:31:42 GMT

Splunk Universal Forwarder

Re: How to rename an index or move everything we have in the main index into another index?

somesoni2 — Tue, 15 Sep 2015 18:54:57 GMT

If by client you mean where you Universal forwarders are installed, then yes, you need to update inputs.conf only on clients. In every type of input (monitoring/batch/script/perfom/eventlog etc) just change the reference of index = main OR wherever index is missing, with index= NEW_INDEX.

Re: How to rename an index or move everything we have in the main index into another index?

ralphw_SAIC — Tue, 15 Sep 2015 18:58:12 GMT

No I did not. It did not sound like I needed to from the docs. I will give this another go tomorrow.

Thanks,