Deployment Architecture

Warning! Deprecated index

joaopcarvalho
Explorer

Hi,

We have some cases were a certain solution was replaced by a newer solution (with different structure, different hosts, different log retrieval and different log info etc...). Therefore we now have two indexes, one old and one new, one active, the other as archive.

Since spunk doesn't have index alias, we thought if it's possible to add some kind of alert each time a user searches by the old index. A small message is enough, for instance something like 'this index was disabled on 01/01/2015 and replaced by index X', just like the one you get it you change your time range explicitly on your search.

Thank you.

P.S. - instead of the messages, a possible solution for this problem might be making the user search using a macro with the name of the system and the macro would expand to index=old Or index=new.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Adding such a macro is no problem at all, go to Settings -> Advanced Search -> Search Macros -> New, give it a name, and enter this as text:

(index=new OR index=old)

Then share this with the users that need it and teach them to use this in their search:

`your_macro_name`
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...