Splunk 6.2.3 on RHEL6. We are growing and I would like to have some consistency in our index naming convention. So, I would like to move everything we have in MAIN into another index.
Is it as easy as cp -rp $SPLUNK_DB/* /foo/bar/
and changing the incoming feeds to point to the new index?
Thanks,
Almost correct, with additional step to stop the splunk before and start after index data copy. See detailed steps here
http://answers.splunk.com/answers/5479/how-to-rename-an-index.html
Almost correct, with additional step to stop the splunk before and start after index data copy. See detailed steps here
http://answers.splunk.com/answers/5479/how-to-rename-an-index.html
Tried the above link and logs were still going to main. Only the local splunk server was sending anything to the new index. I updated inputs.conf with "index = NEW_INDEX" before I started splunk back up.
Any ideas on why nothing external was going to the new index? We are using the Universal Forwarder, if that helps any, on our clients.
Splunk Universal Forwarder
No I did not. It did not sound like I needed to from the docs. I will give this another go tomorrow.
Thanks,
did you update your UF inputs.conf monitor stanzas as well to include the index= NEW_INDEX and restart?
Sorry to sound like an id10t, but what do you mean by "UF"?
Also, I only updated inputs.conf on the server. At least that is how I read it. Do I also need to update it on the clients?
If by client you mean where you Universal forwarders are installed, then yes, you need to update inputs.conf only on clients. In every type of input (monitoring/batch/script/perfom/eventlog etc) just change the reference of index = main OR wherever index is missing, with index= NEW_INDEX.