Merging two distinct Splunk into one

[yanlajeunesse]

Hello,

Let's say the company has two departments that used Splunk independantly, and now they want to merge them together into a single Splunk environment.

Both departments have indexes with the same name, but that contains different data, and they also have dashboards and SPL referring these indexes.

I know i can move all indexes from department B to department A, and give them a new name if i want to keep the data separate (for retention and security purposes). However, this will require manual work to modify all the dashboards and various knowledge objects that refer to the original index's name.

Is there an easier way to do this than to manually adapt everything?

Thank you!

[woodcock · Accepted solution]

There is no way to avoid the manual work of fixing the dashbaords and searches but you can avoid the work of renaming the index values/directories. You can keep the Indexers as-is and point a master Search Head to all of them and then change the searches that say index=foo into EITHER index=foo AND splunk_server IN("list", "of", "Indexer", "***TIER ONE***", "servers", "here") OR index=foo AND splunk_server IN("list", "of", "Indexer", "***TIER TWO***", "servers", "here") OR

[yanlajeunesse]

Thank you! It confirms my initial thought but you added an interesting possibility that we had not considered.

[woodcock]

You could even deploy this as a pair of marcos called index_equals_foo_TEIR1 and index_equals_foo_TIER2