Deployment Architecture

invalid/deleted index

Splunk_U
Path Finder

I want that Unix TA will send data to index abc instead of index os. So i have changed the outputs.conf file pressent as local with the index name as abc. Now all the data are going to index abc. But i am getting an error that invalid/deleted index=os....
can you please help me out?

Tags (2)

piebob
Splunk Employee
Splunk Employee

where are you seeing the errors? are you running the UNIX app as well on your search head? you're probably seeing other artifacts (like maybe saved searches that power dashboards) that are part of the UNIX app and that also expect the original index name. you might want to just grep $splunk_home/etc/apps/ for the index name.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...