can a sourcetype be linked into a index?

[ebaileytu]

I have need to move a sourcetype to a new index because the retention requirements for the sourcetype changed. The issue is that a number of reports/alerts/dashboards reference the sourcetype with the index as well so moving the sourcetype will require everything that references it to be updated with the new index name.

Can the sourcetype be linked or aliased into the old index to avoid rework?

Thanks in advance

[lguinn2 · Accepted solution]

No, there is no way to point the searches to the old index via an alias or other hidden mechanism.
You could update the searches to read

(index=A OR index=B) sourcetype=abc

Eventually the old "index=A" part of the search will return nothing, but it won't cause errors or problems. And someday you can remove the "index=A" part.

[woodcock]

You can hide the index= stuff inside of an eventtype (or a macro) and then update that KO after the events age out.

[ebaileytu]

Too bad - of course this is the one sourcetype without an corresponding eventtype. Thanks and enjoy your Friday.