Installation

Splunk 6 indexing

kmattern
Builder

I just upgraded to Splunk 6.0.2. Why did it override all of my indexes. In 5.0.4 I specified a separate index for each of my major sourcetypes. But Splunk 6 blithely decided to dump everything into main. What gives?

Tags (3)
0 Karma

kmattern
Builder

Sigh... The forwarder was sending the log to multiple indexers and specifying the index as main. I'll have to find another way to get the data consumed.

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

Did you put your configuration files in the default directory vs local?

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

It really shouldn't of overrided the configurations if you have things in local.

Do you have enterprise support? If so, can you get a ticket opened up and let me know the ticket number..

0 Karma

kmattern
Builder

I always use local. When I set up 5.0.4 six months ago I defined all my indexes then. If I search the original indexes for events prior to the upgrade, everything is there.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...