I have an index called
high with sourcetype
logs sourcetype is continuously indexing logs under \logs dir.
I have decided to create a new index and want to move those logs to that new index called
I have successfully moved the events to Medium,
index="high" sourcetype=logs | collect index="Medium"
but I can't see the events with the sourcetype
no events found
It works and shows all the events, but not real-time logs.
And when new logs were updated under
logs sourcetype, Splunk is showing those real-time logs under index
high, not under the
How to show real-time events under
medium index instead of
high index with sourcetype