Splunk Enterprise

influence of removing index for ITSI

kanam
Loves-to-Learn Everything

Now I want to remove one index.

However I've already create some service and entity related to the index in ITSI.

After removing index once, I'll create new index as same name.

Is there some influence for ITSI?

Tags (1)
0 Karma

kanam
Loves-to-Learn Everything

richgalloway,

 

Thank you for reply.

How about when I create new index as same index name?

ex) Now I use index "TEST" for ITSI

     Once I delete it.

     And I create index "TEST" for ITSI again.

 

Then, will ITSI run well same as before?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

My answer is predicated on the index name not changing, as stated in the original posting.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes.

When the index is removed, ITSI will not find data in that index.  Depending on what your searches do, ITSI could be silent or it could generate alerts (missing entities, service is down, etc.).

The same will be true when the index is replaced until there is sufficient data in the index to satisfy the searches.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...