Deployment Architecture

Warning! Deprecated index

joaopcarvalho
Explorer

Hi,

We have some cases were a certain solution was replaced by a newer solution (with different structure, different hosts, different log retrieval and different log info etc...). Therefore we now have two indexes, one old and one new, one active, the other as archive.

Since spunk doesn't have index alias, we thought if it's possible to add some kind of alert each time a user searches by the old index. A small message is enough, for instance something like 'this index was disabled on 01/01/2015 and replaced by index X', just like the one you get it you change your time range explicitly on your search.

Thank you.

P.S. - instead of the messages, a possible solution for this problem might be making the user search using a macro with the name of the system and the macro would expand to index=old Or index=new.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Adding such a macro is no problem at all, go to Settings -> Advanced Search -> Search Macros -> New, give it a name, and enter this as text:

(index=new OR index=old)

Then share this with the users that need it and teach them to use this in their search:

`your_macro_name`
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...