Knowledge Management

Is it possible to alias a command to another one?



So we're slowly moving off of index=java to index=applicationlogs for a few reasons. Is there a way to alias index=java to index=applicationlogs for users?

0 Karma

Splunk Employee
Splunk Employee

No, there is no way to transparently alias without changing existing searches. @cusello's approach is valid. You can also create a macro, for example set_app_index, that resolves to index=java OR index=applicationlogs.
Either way, you will have to update saved searches, reports and dashboards with inline searches to take advantage of the abstraction.

0 Karma


You can use eventtypes instead of indexes.
In other words:
You have to create an eventtype like the folliwing
Index=java OR index=applicationlogs
And then on your searches use
Eventtype=my_eventtype instead of index= applicationlogs

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!