Splunk Search

Rename an index in a Splunk distributed deployment

dsofoulis
Path Finder

I would like to change the name of an index without losing any data etc.
Is it possible to modify an index name in the indexes.conf file on the cluster master. After changing the name, I'll push the config to my indexes using the cluster master.

e.g. of changing name in indexes.conf

[index-for-indexing]
homePath = $SPLUNK_DB/index-for-indexing/db
coldPath = $SPLUNK_DB/index-for-indexing/colddb
thawedPath = $SPLUNK_DB/index-for-indexing/thaweddb
repFactor = auto

to

[no-indexing-here]
homePath = $SPLUNK_DB/no-indexing-here/db
coldPath = $SPLUNK_DB/no-indexing-here/colddb
thawedPath = $SPLUNK_DB/no-indexing-here/thaweddb
repFactor = auto

Am I heading down the right track or am I completely wrong?
P.S I am using a distributed deployment.

0 Karma

sassens1
Path Finder

Hi

if you do this, your old data will not be migrated to your new index.

I'm planing to do this in 3 steps:
- create the new index on the DS and deploy the conf (don't forget restarting all your indexers to apply)
- start indexing on the new index (or stop indexing on the old old) and then move the files from the old index location to the new one
- remove old index config from the DS and deploy it.

check this other answer

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...