Getting Data In

How to change the index for a certain sourcetype?

vkakani60
Path Finder

I have an index called high with sourcetype logs

logs sourcetype is continuously indexing logs under \logs dir.

I have decided to create a new index and want to move those logs to that new index called Medium.

I have successfully moved the events to Medium,

index="high" sourcetype=logs | collect index="Medium"

but I can't see the events with the sourcetype

index="Medium" sourcetype=logs 
no events found

index="Medium"

It works and shows all the events, but not real-time logs.
And when new logs were updated under logs sourcetype, Splunk is showing those real-time logs under index high, not under the Medium index.

How to show real-time events under medium index instead of high index with sourcetype logs ?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

After the collect command, the sourcetype is changed to stash. I don't think this is the right way to move data between indexes.
First, you should modify your data input configurations (inputs.conf) on forwarders/data source to use index=Medium instead of index=High. This should make all the real-time/latest data to go to index=Medium.
Then, for moving historical data, easy option would be create an eventtype/macro which will collect data from both the indexes (high and Medium). Once all the data in index=high is retired (based on retention policy set), you can update the macro/eventtype to just use index=Medium.

OR follow method described here
https://answers.splunk.com/answers/32176/is-it-possible-to-migrate-indexed-buckets-to-a-different-in...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...