Splunk Search

How to rename a database input from "db_input_1" to "db_input_X" without losing state.xml values and maintain data integrity?

Path Finder


I've defined database input "db_input_1" and that points to index "index_1"...the setup is in production meaning the state.xml has latest rising column values (for incremental extracts)

I've a need to rename the database input to "db_input_X".

What would be my steps to follow to be able to make the change so that I don't lose the state.xml value, and my data integrity is not disturbed.

thanks, ronak

0 Karma

Splunk Employee
Splunk Employee

Hi, it won't work to do this. The architecturally different DB Connect 2 would work though.

0 Karma