Deployment Architecture

Warning! Deprecated index



We have some cases were a certain solution was replaced by a newer solution (with different structure, different hosts, different log retrieval and different log info etc...). Therefore we now have two indexes, one old and one new, one active, the other as archive.

Since spunk doesn't have index alias, we thought if it's possible to add some kind of alert each time a user searches by the old index. A small message is enough, for instance something like 'this index was disabled on 01/01/2015 and replaced by index X', just like the one you get it you change your time range explicitly on your search.

Thank you.

P.S. - instead of the messages, a possible solution for this problem might be making the user search using a macro with the name of the system and the macro would expand to index=old Or index=new.

0 Karma


Adding such a macro is no problem at all, go to Settings -> Advanced Search -> Search Macros -> New, give it a name, and enter this as text:

(index=new OR index=old)

Then share this with the users that need it and teach them to use this in their search:

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...