Getting Data In

Rename an index in 4.1.8

cosmic_cow
Engager

We've renamed an environment that was indexing to an identically named index. Currently, the renamed environment is indexing to the old name. Is there a way to rename an index? If so, how?

Tags (3)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You can't really rename an index, but you can create a new index with the name you want (via indexes.conf/GUI) and move the data from the old index to the new index.

You would need to stop Splunk, then move the $SPLUNK_DB/<old_index> directory to $SPLUNK_DB/<new_index> and then start Splunk. That should be all you'd need to do to get the data in the new index. Keep in mind any searches that reference the other index will need to be changed.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You can't really rename an index, but you can create a new index with the name you want (via indexes.conf/GUI) and move the data from the old index to the new index.

You would need to stop Splunk, then move the $SPLUNK_DB/<old_index> directory to $SPLUNK_DB/<new_index> and then start Splunk. That should be all you'd need to do to get the data in the new index. Keep in mind any searches that reference the other index will need to be changed.

harry2007gsp
Path Finder

Is Splunk gonna charge us for this move?

0 Karma

churyn_splunk
Splunk Employee
Splunk Employee

No. This administrative procedure moves the index files "underneath the hood" so to speak. The files are already parsed and do not go through the parsing/indexing phase again. Thus, no license meter.

jbsplunk
Splunk Employee
Splunk Employee

Glad to hear that it worked, be sure to click the check box to accept the answer so it will show as you accepting it.

cosmic_cow
Engager

Worked like a charm. Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...