Solved: Solution : index renaming not working when using ...

splunkreal

Hello, if you are using _TCP_ROUTING and index rename on target platform, logs may go to "last chance index"

* If this helps, please upvote or accept solution if it solved *

splunkreal

In this case review inputs.conf sourcetype and change it if you use default pretrained :

https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Listofpretrainedsourcetypes

"The source types marked with an asterisk ( * ) use the INDEXED_EXTRACTIONS attribute, which sets other attributes in props.conf to specific defaults and requires special handling to forward to another Splunk platform instance. See Forward fields extracted from structured data files."

* If this helps, please upvote or accept solution if it solved *

View solution in original post

splunkreal

In this case review inputs.conf sourcetype and change it if you use default pretrained :

https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Listofpretrainedsourcetypes

"The source types marked with an asterisk ( * ) use the INDEXED_EXTRACTIONS attribute, which sets other attributes in props.conf to specific defaults and requires special handling to forward to another Splunk platform instance. See Forward fields extracted from structured data files."

* If this helps, please upvote or accept solution if it solved *

Solution : index renaming not working when using _TCP_ROUTING

host

index

indexer

props.conf

source

sourcetype

transforms.conf

universal forwarder

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

Monitoring Amazon Elastic Kubernetes Service (EKS)