I have need to move a sourcetype to a new index because the retention requirements for the sourcetype changed. The issue is that a number of reports/alerts/dashboards reference the sourcetype with the index as well so moving the sourcetype will require everything that references it to be updated with the new index name.
Can the sourcetype be linked or aliased into the old index to avoid rework?
Thanks in advance
↧