Getting Data In

can a sourcetype be linked into a index?

ebaileytu
Communicator

I have need to move a sourcetype to a new index because the retention requirements for the sourcetype changed. The issue is that a number of reports/alerts/dashboards reference the sourcetype with the index as well so moving the sourcetype will require everything that references it to be updated with the new index name.

Can the sourcetype be linked or aliased into the old index to avoid rework?

Thanks in advance

0 Karma
1 Solution

lguinn2
Legend

No, there is no way to point the searches to the old index via an alias or other hidden mechanism.
You could update the searches to read

(index=A OR index=B) sourcetype=abc

Eventually the old "index=A" part of the search will return nothing, but it won't cause errors or problems. And someday you can remove the "index=A" part.

View solution in original post

0 Karma

lguinn2
Legend

No, there is no way to point the searches to the old index via an alias or other hidden mechanism.
You could update the searches to read

(index=A OR index=B) sourcetype=abc

Eventually the old "index=A" part of the search will return nothing, but it won't cause errors or problems. And someday you can remove the "index=A" part.

0 Karma

woodcock
Esteemed Legend

You can hide the index= stuff inside of an eventtype (or a macro) and then update that KO after the events age out.

0 Karma

ebaileytu
Communicator

Too bad - of course this is the one sourcetype without an corresponding eventtype. Thanks and enjoy your Friday.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...