We're in the process of migrating our data-collection paradigm from:
[In-store devices] -> [ Google Analytics (GA)] -> Splunk (data has been stored in Index A)
to:
[In-store devices] -> [Splunk] (data being stored in Index B)
At the end of June, we are cutting off our GA connection and moving directly to Splunk. Unfortunately, a few of the fields have the same name in each index, but most have a different name in the newer index.
The issue is we have a dashboard that displays year-over-year data for these devices that we need to maintain and continue using going forward. So my question to all you brilliant minds out there is this - how to I modify the dashboard to continue to use the existing data from previous years but begin using the new data/index at a particular date, let's say June 25, 2023. For the end-user, the dashboard should continue to look as it always has, but behind the scenes it'll be using both indexes.
I'm not very strong on SPL and am getting confused on whether this would be case to try and use a Union, or a Join, or ... ?
Any, and all help from you guys is *greatly* appreciated!
Thanks!
P.S. - we have NOT migrated to Dashboard Studio yet and are still running 8.2.4 for the time-being. I'm not opposed to using DS on this however ...
