https://community.splunk.com/t5/Getting-Data-In/Can-I-Index-Data-Not-Previously-Indexed/m-p/109045#M22956 <P>I have a user who has collected data from his servers that was indexed by Splunk using the "main" index. Now he wants to create his own, app-specific index. Can we index the data he has already collected to use this new index?</P> Tue, 15 Nov 2011 00:39:32 GMT rgcurry 2011-11-15T00:39:32Z https://community.splunk.com/t5/Getting-Data-In/Can-I-Index-Data-Not-Previously-Indexed/m-p/109045#M22956 <P>I have a user who has collected data from his servers that was indexed by Splunk using the "main" index. Now he wants to create his own, app-specific index. Can we index the data he has already collected to use this new index?</P> Tue, 15 Nov 2011 00:39:32 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-Index-Data-Not-Previously-Indexed/m-p/109045#M22956 rgcurry 2011-11-15T00:39:32Z https://community.splunk.com/t5/Getting-Data-In/Can-I-Index-Data-Not-Previously-Indexed/m-p/109046#M22957 <P>No, data can not be moved from one index to another. Of course you could re-index it into the new index (if the data is still on file somewhere), and remove it from the <CODE>main</CODE> index. Well, you cannot really remove it from main, but you can make it 'invisible' so that it never shows up as the result of a search.</P> <P>Search this forum for 'delete' to learn more on how this works.</P> <P>/kristian</P> Tue, 15 Nov 2011 15:13:17 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-Index-Data-Not-Previously-Indexed/m-p/109046#M22957 kristian_kolb 2011-11-15T15:13:17Z