Getting Data In

Solution : index renaming not working when using _TCP_ROUTING

splunkreal
Motivator

Hello, if you are using _TCP_ROUTING and index rename on target platform, logs may go to "last chance index" 

 

 

 

* If this helps, please upvote or accept solution if it solved *
0 Karma
1 Solution

splunkreal
Motivator

In this case review inputs.conf sourcetype and change it if you use default pretrained :

 

https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Listofpretrainedsourcetypes

 

"The source types marked with an asterisk ( * ) use the INDEXED_EXTRACTIONS attribute, which sets other attributes in props.conf to specific defaults and requires special handling to forward to another Splunk platform instance. See Forward fields extracted from structured data files."

* If this helps, please upvote or accept solution if it solved *

View solution in original post

0 Karma

splunkreal
Motivator

In this case review inputs.conf sourcetype and change it if you use default pretrained :

 

https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Listofpretrainedsourcetypes

 

"The source types marked with an asterisk ( * ) use the INDEXED_EXTRACTIONS attribute, which sets other attributes in props.conf to specific defaults and requires special handling to forward to another Splunk platform instance. See Forward fields extracted from structured data files."

* If this helps, please upvote or accept solution if it solved *
0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...