Splunk Enterprise

influence of removing index for ITSI

kanam
Loves-to-Learn Everything

Now I want to remove one index.

However I've already create some service and entity related to the index in ITSI.

After removing index once, I'll create new index as same name.

Is there some influence for ITSI?

Tags (1)
0 Karma

kanam
Loves-to-Learn Everything

richgalloway,

 

Thank you for reply.

How about when I create new index as same index name?

ex) Now I use index "TEST" for ITSI

     Once I delete it.

     And I create index "TEST" for ITSI again.

 

Then, will ITSI run well same as before?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

My answer is predicated on the index name not changing, as stated in the original posting.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes.

When the index is removed, ITSI will not find data in that index.  Depending on what your searches do, ITSI could be silent or it could generate alerts (missing entities, service is down, etc.).

The same will be true when the index is replaced until there is sufficient data in the index to satisfy the searches.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...