Splunk Search
Highlighted

Rename an index in a Splunk distributed deployment

Path Finder

I would like to change the name of an index without losing any data etc.
Is it possible to modify an index name in the indexes.conf file on the cluster master. After changing the name, I'll push the config to my indexes using the cluster master.

e.g. of changing name in indexes.conf

[index-for-indexing]
homePath = $SPLUNKDB/index-for-indexing/db
coldPath = $SPLUNK
DB/index-for-indexing/colddb
thawedPath = $SPLUNK_DB/index-for-indexing/thaweddb
repFactor = auto

to

[no-indexing-here]
homePath = $SPLUNKDB/no-indexing-here/db
coldPath = $SPLUNK
DB/no-indexing-here/colddb
thawedPath = $SPLUNK_DB/no-indexing-here/thaweddb
repFactor = auto

Am I heading down the right track or am I completely wrong?
P.S I am using a distributed deployment.

0 Karma
Highlighted

Re: Rename an index in a Splunk distributed deployment

Path Finder

Hi

if you do this, your old data will not be migrated to your new index.

I'm planing to do this in 3 steps:
- create the new index on the DS and deploy the conf (don't forget restarting all your indexers to apply)
- start indexing on the new index (or stop indexing on the old old) and then move the files from the old index location to the new one
- remove old index config from the DS and deploy it.

check this other answer

0 Karma