Splunk Search

Rename an index in a Splunk distributed deployment

Path Finder

I would like to change the name of an index without losing any data etc.
Is it possible to modify an index name in the indexes.conf file on the cluster master. After changing the name, I'll push the config to my indexes using the cluster master.

e.g. of changing name in indexes.conf

homePath = $SPLUNK_DB/index-for-indexing/db
coldPath = $SPLUNK_DB/index-for-indexing/colddb
thawedPath = $SPLUNK_DB/index-for-indexing/thaweddb
repFactor = auto


homePath = $SPLUNK_DB/no-indexing-here/db
coldPath = $SPLUNK_DB/no-indexing-here/colddb
thawedPath = $SPLUNK_DB/no-indexing-here/thaweddb
repFactor = auto

Am I heading down the right track or am I completely wrong?
P.S I am using a distributed deployment.

0 Karma

Path Finder


if you do this, your old data will not be migrated to your new index.

I'm planing to do this in 3 steps:
- create the new index on the DS and deploy the conf (don't forget restarting all your indexers to apply)
- start indexing on the new index (or stop indexing on the old old) and then move the files from the old index location to the new one
- remove old index config from the DS and deploy it.

check this other answer

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...