Can I redirect index=main which is embedded into a dashboard to another index seamlessly to improve performance and data mgmt?

[damonmanni]

I have a customer who has been using/pointing to index=main for his searches and where his data is stored and also has this embedded in his dashboard queries, etc.

I would like to:
1) Create a new index that relates to his data better
2) move his data out of main and to that new index
3) and do not disturb his dashboards by asking him to change all his queries to point to the new index. Seamless for him.

All advice is appreciated.
cheers,
D

[niketn]

@damonmanni, Following are the steps that you should try

1) Unless already present, create an eventtype knowledge object in Splunk for the index/source/sourcetype which all are applicable in your main search. If possible also create a macro to call the eventtype so that changes to index/source/sourcetype can be parameterized.

2) Stop Data Input to main index.

3) Use collect command to move data from old index to new. You have to make sure all data/fields in the old index are being moved to new index as is (you can do so by running collect command in testmode. PS: sourcetype by default is stash which does not cost against license unless it is changed. For your use case you need to also override sourcetype for data in the new index so that new data remains in sync with old data. So, you should be aware that such kind of data move with change in sourcetype would cost Splunk license volume.

4) Point eventtype to the new index and test your dashboard.

5) Have your data input start sending data to new index.

[damonmanni]

Thank u once again sir. I am working on your advice.
cheers,
D

[damonmanni]

Niket,
Thanks so much for the quick and detailed answer. A bit above my head at the moment but I will learn & work at it and post back on results.

cheers,
Damon