How to rename an index or move everything we have in the main index into another index?

[ralphw_SAIC]

Splunk 6.2.3 on RHEL6. We are growing and I would like to have some consistency in our index naming convention. So, I would like to move everything we have in MAIN into another index.

Is it as easy as cp -rp $SPLUNK_DB/* /foo/bar/ and changing the incoming feeds to point to the new index?

Thanks,

[somesoni2 · Accepted solution]

Almost correct, with additional step to stop the splunk before and start after index data copy. See detailed steps here

http://answers.splunk.com/answers/5479/how-to-rename-an-index.html

[ralphw_SAIC]

Tried the above link and logs were still going to main. Only the local splunk server was sending anything to the new index. I updated inputs.conf with "index = NEW_INDEX" before I started splunk back up.

Any ideas on why nothing external was going to the new index? We are using the Universal Forwarder, if that helps any, on our clients.

[rphillips_splk]

Splunk Universal Forwarder

[ralphw_SAIC]

No I did not. It did not sound like I needed to from the docs. I will give this another go tomorrow.

Thanks,

[rphillips_splk]

did you update your UF inputs.conf monitor stanzas as well to include the index= NEW_INDEX and restart?

[ralphw_SAIC]

Sorry to sound like an id10t, but what do you mean by "UF"?

Also, I only updated inputs.conf on the server. At least that is how I read it. Do I also need to update it on the clients?

[somesoni2]

If by client you mean where you Universal forwarders are installed, then yes, you need to update inputs.conf only on clients. In every type of input (monitoring/batch/script/perfom/eventlog etc) just change the reference of index = main OR wherever index is missing, with index= NEW_INDEX.