<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Migrating data from one index to another in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54338#M10512</link>
    <description>&lt;P&gt;Unfortunately, there's no way to surgically transfer data from one index to another. If you want the existing access events in the main index, then you can &lt;A href="http://www.splunk.com/base/Documentation/latest/Admin/RemovedatafromSplunk" rel="nofollow"&gt;delete&lt;/A&gt; them and re-index into the new access index.&lt;/P&gt;</description>
    <pubDate>Tue, 21 Sep 2010 04:29:43 GMT</pubDate>
    <dc:creator>hulahoop</dc:creator>
    <dc:date>2010-09-21T04:29:43Z</dc:date>
    <item>
      <title>Migrating data from one index to another</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54337#M10511</link>
      <description>&lt;P&gt;I've been using the default "main" index for all my indexing. I'm at the point where I think it would be best to branch out a bit and have some separate indexes.&lt;/P&gt;

&lt;P&gt;Suppose I create an index "access" which will store our web server access logs. Is there a way to migrate my existing access log data from the "main" index into the new "access" index? I don't want to have to specify two different indexes if/when I search for older access log information. &lt;/P&gt;

&lt;P&gt;Thanks!&lt;/P&gt;</description>
      <pubDate>Tue, 21 Sep 2010 03:40:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54337#M10511</guid>
      <dc:creator>Branden</dc:creator>
      <dc:date>2010-09-21T03:40:23Z</dc:date>
    </item>
    <item>
      <title>Re: Migrating data from one index to another</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54338#M10512</link>
      <description>&lt;P&gt;Unfortunately, there's no way to surgically transfer data from one index to another. If you want the existing access events in the main index, then you can &lt;A href="http://www.splunk.com/base/Documentation/latest/Admin/RemovedatafromSplunk" rel="nofollow"&gt;delete&lt;/A&gt; them and re-index into the new access index.&lt;/P&gt;</description>
      <pubDate>Tue, 21 Sep 2010 04:29:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54338#M10512</guid>
      <dc:creator>hulahoop</dc:creator>
      <dc:date>2010-09-21T04:29:43Z</dc:date>
    </item>
    <item>
      <title>Re: Migrating data from one index to another</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54339#M10513</link>
      <description>&lt;P&gt;There is no need for you to do this. You can just make the old and the new indexes "default" for the user role(s).&lt;/P&gt;</description>
      <pubDate>Tue, 21 Sep 2010 05:10:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54339#M10513</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2010-09-21T05:10:40Z</dc:date>
    </item>
    <item>
      <title>Re: Migrating data from one index to another</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54340#M10514</link>
      <description>&lt;P&gt;This is the easiest way to combine your current access events in both the new and old indexes.&lt;/P&gt;</description>
      <pubDate>Tue, 21 Sep 2010 05:45:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54340#M10514</guid>
      <dc:creator>hulahoop</dc:creator>
      <dc:date>2010-09-21T05:45:00Z</dc:date>
    </item>
    <item>
      <title>Re: Migrating data from one index to another</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54341#M10515</link>
      <description>&lt;P&gt;Just to clarify... are you saying I can configure it to search "access" and "main" by default without having to specify them in the search string?&lt;/P&gt;</description>
      <pubDate>Tue, 21 Sep 2010 20:13:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54341#M10515</guid>
      <dc:creator>Branden</dc:creator>
      <dc:date>2010-09-21T20:13:56Z</dc:date>
    </item>
    <item>
      <title>Re: Migrating data from one index to another</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54342#M10516</link>
      <description>&lt;P&gt;Oh I see how to do it now. It's in the Roles section of the manager (duh). &lt;BR /&gt;
Odd... when I try to create a new role, it won't let me add capabilities to the role. No matter what capabilities I select, it says the role only has 1 capability (delete by keyword). This happens even if I clone an existing role ('admin' in this case). Could this be a bug?&lt;/P&gt;</description>
      <pubDate>Tue, 21 Sep 2010 20:39:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Migrating-data-from-one-index-to-another/m-p/54342#M10516</guid>
      <dc:creator>Branden</dc:creator>
      <dc:date>2010-09-21T20:39:53Z</dc:date>
    </item>
  </channel>
</rss>

