Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

can a sourcetype be linked into a index?

$
0
0
I have need to move a sourcetype to a new index because the retention requirements for the sourcetype changed. The issue is that a number of reports/alerts/dashboards reference the sourcetype with the index as well so moving the sourcetype will require everything that references it to be updated with the new index name. Can the sourcetype be linked or aliased into the old index to avoid rework? Thanks in advance

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>