Splunk Search

Merging two distinct Splunk into one

yanlajeunesse
Explorer

Hello,

Let's say the company has two departments that used Splunk independantly, and now they want to merge them together into a single Splunk environment.

Both departments have indexes with the same name, but that contains different data, and they also have dashboards and SPL referring these indexes.

I know i can move all indexes from department B to department A, and give them a new name if i want to keep the data separate (for retention and security purposes). However, this will require manual work to modify all the dashboards and various knowledge objects that refer to the original index's name.

Is there an easier way to do this than to manually adapt everything?

Thank you!

0 Karma
1 Solution

woodcock
Esteemed Legend

There is no way to avoid the manual work of fixing the dashbaords and searches but you can avoid the work of renaming the index values/directories. You can keep the Indexers as-is and point a master Search Head to all of them and then change the searches that say index=foo into EITHER index=foo AND splunk_server IN("list", "of", "Indexer", "***TIER ONE***", "servers", "here") OR index=foo AND splunk_server IN("list", "of", "Indexer", "***TIER TWO***", "servers", "here") OR

View solution in original post

0 Karma

woodcock
Esteemed Legend

There is no way to avoid the manual work of fixing the dashbaords and searches but you can avoid the work of renaming the index values/directories. You can keep the Indexers as-is and point a master Search Head to all of them and then change the searches that say index=foo into EITHER index=foo AND splunk_server IN("list", "of", "Indexer", "***TIER ONE***", "servers", "here") OR index=foo AND splunk_server IN("list", "of", "Indexer", "***TIER TWO***", "servers", "here") OR

0 Karma

yanlajeunesse
Explorer

Thank you! It confirms my initial thought but you added an interesting possibility that we had not considered.

0 Karma

woodcock
Esteemed Legend

You could even deploy this as a pair of marcos called index_equals_foo_TEIR1 and index_equals_foo_TIER2

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...