Installation

Splunk 6 indexing

kmattern
Builder

I just upgraded to Splunk 6.0.2. Why did it override all of my indexes. In 5.0.4 I specified a separate index for each of my major sourcetypes. But Splunk 6 blithely decided to dump everything into main. What gives?

Tags (3)
0 Karma

kmattern
Builder

Sigh... The forwarder was sending the log to multiple indexers and specifying the index as main. I'll have to find another way to get the data consumed.

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

Did you put your configuration files in the default directory vs local?

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

It really shouldn't of overrided the configurations if you have things in local.

Do you have enterprise support? If so, can you get a ticket opened up and let me know the ticket number..

0 Karma

kmattern
Builder

I always use local. When I set up 5.0.4 six months ago I defined all my indexes then. If I search the original indexes for events prior to the upgrade, everything is there.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...