Splunk Enterprise Trial version - Need to change the index name

[VijaySrrie]

Hi,

I have downloaded Splunk enterprise Trial version for Windows 64 bit. Only the Search Head is accessible?
I created a text file and got into splunk and I could see the logs under main index if suppose I need to change the name of the index where should I change? or due to trial version all the logs by default goes to main index?

[richgalloway · Accepted solution]

The trial version of Splunk is a standalone instance - a combined search head and indexer.

It's not clear what is meant by "change the name of the index".

If you want to have your data go to an index other than "main", it's a matter of changing the appropriate inputs.conf file. Replace index = main with index = <something else> in the stanza for your text file. <something else> will be the name of an index from Settings->Indexes.

If you want to change the name of index 'main' to something else, that can be done. Stop Splunk, edit indexes.conf and change main to <some new name> throughout. Rename the index directory $SPLUNK_HOME/var/lib/splunk/main to $SPLUNK_HOME/var/lib/splunk/<some new name> then start Splunk.

[VijaySrrie]

Is it possible to stop the Splunk from GUI ? do the necessary changes in GUi ?
If not from GUI where can I find the indexes.conf file?

[richgalloway]

You can restart Splunk from the GUI, but you cannot stop it (how would you start it?).
Indexes cannot be renamed from the GUI.
Inputs can be changed to send to a different index via the GUI.
The Linux find command can help you find the indexes.conf files. find /opt/splunk -name indexes.conf. Or use find /opt/splunk -name indexes.conf -print0 | xargs -r0 egrep "index\s=\sfoo" to references to index 'foo'.

[VijaySrrie]

ok Thank You