I have a single index that has just been collecting data for months now. I want to use some splunk apps now (citrix / active directory / cisco) . How can i accomplish this?
is the best plan of attack to export the data into the new databases? (how do i do that?)
thanks in advance
I am not sure what you mean by exporting the data into new databases...With regards to using the splunk app, have you installed them yet and if so, is there no data displaying(Is this the issue you are facing?)
sorry i'm new to splunk and its terminology.
i have an existing splunk instance with a single index that has all my data.
i have a new separate installation with 2 indexers and 1 search head.
i've installed the citrix xendesktop/xenapp apps and i noticed how it auto created specific indexes. I just assumed that in order to use the different apps the data had to be in the specific indexes.
Not sure what the easy way to resolve this issue would be, but I would guess you could either, change the app to point to your old data as well as your new data or use the collect command to move the data into the newly created app index
The information you search for will then be piped into the index you need
Not sure if there is a better resolution to this
My end goal was to reindex the data for cisco security app.
i ended up running a query for my cisco hosts.
i export to raw
then imported using
splunk.exe add oneshot d:\gdtest.raw -host myHostIP -rename-source udp:514