I just upgraded to Splunk 6.0.2. Why did it override all of my indexes. In 5.0.4 I specified a separate index for each of my major sourcetypes. But Splunk 6 blithely decided to dump everything into main. What gives?
Sigh... The forwarder was sending the log to multiple indexers and specifying the index as main. I'll have to find another way to get the data consumed.
Did you put your configuration files in the default directory vs local?
It really shouldn't of overrided the configurations if you have things in local.
Do you have enterprise support? If so, can you get a ticket opened up and let me know the ticket number..
I always use local. When I set up 5.0.4 six months ago I defined all my indexes then. If I search the original indexes for events prior to the upgrade, everything is there.