replaced with new index with old one in inputs.conf

[sathwikr076]

I have changed the index name for a log ingestion to a new one but the logs are still ingesting to the old index. I cannot understand why the logs are not ingesting to new index. Please let me know if anyone have any idea.

Thanks.

[jacobpevans]

Greetings @sathwikr076,

1. Does the index exist on the indexer that the data is being forwarded to?
2. Did you restart the Splunk forwarder service on the machine that is monitoring the log?

Cheers,
Jacob

[sathwikr076]

Thanks for the response. Yes, the new index exist on all the indexers and i have restarted the forwarder. checked if the index name has changed on the server by the application team and it has the new index in the inputs.conf but still it is ingesting to the old index.

[gcusello]

Hi sathwikr076,
how do you changed destination index?

• in inputs.conf on Universal Forwarders,
• in overriding on Indexers?

If on UFs, after update, did you restarted Splunk on UFs?
If on Indexers, after update, did you restarted Splunk on Indexers? have you in the middle any Heavy Forwarders?

Bye.
Giuseppe

[sathwikr076]

i have changed on UF and restarted the service through deployment server remotely as i do not have access to the server. i checked the internal logs and i can see
Metrics - group=per_index_thruput, series="new_index", kbps=0.22774524335479657, eps=0.19367014189230036, kb=7.0556640625, ev=6, avg_age=9110.833333333334, max_age=54545 but still it is ingesting to the old index. i just asked the application team to restart the forwarder directly on the server.