Installation

Splunk 6 indexing

kmattern
Builder

I just upgraded to Splunk 6.0.2. Why did it override all of my indexes. In 5.0.4 I specified a separate index for each of my major sourcetypes. But Splunk 6 blithely decided to dump everything into main. What gives?

Tags (3)
0 Karma

kmattern
Builder

Sigh... The forwarder was sending the log to multiple indexers and specifying the index as main. I'll have to find another way to get the data consumed.

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

Did you put your configuration files in the default directory vs local?

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

It really shouldn't of overrided the configurations if you have things in local.

Do you have enterprise support? If so, can you get a ticket opened up and let me know the ticket number..

0 Karma

kmattern
Builder

I always use local. When I set up 5.0.4 six months ago I defined all my indexes then. If I search the original indexes for events prior to the upgrade, everything is there.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...