Splunk Enterprise

influence of removing index for ITSI

kanam
Loves-to-Learn Everything

Now I want to remove one index.

However I've already create some service and entity related to the index in ITSI.

After removing index once, I'll create new index as same name.

Is there some influence for ITSI?

Tags (1)
0 Karma

kanam
Loves-to-Learn Everything

richgalloway,

 

Thank you for reply.

How about when I create new index as same index name?

ex) Now I use index "TEST" for ITSI

     Once I delete it.

     And I create index "TEST" for ITSI again.

 

Then, will ITSI run well same as before?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

My answer is predicated on the index name not changing, as stated in the original posting.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes.

When the index is removed, ITSI will not find data in that index.  Depending on what your searches do, ITSI could be silent or it could generate alerts (missing entities, service is down, etc.).

The same will be true when the index is replaced until there is sufficient data in the index to satisfy the searches.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...