<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Move events from an index to another one in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Move-events-from-an-index-to-another-one/m-p/43512#M8124</link>
    <description>&lt;P&gt;I'm guessing this is a 1 off and you don't have the raw data inputs anymore ?&lt;/P&gt;

&lt;P&gt;If thats true,&lt;/P&gt;

&lt;P&gt;If index2 does not exist already, by far the easiest solution would be to make a copy of index1 called index2, delete everything but kind3 and kind4 from index2, then delete kind3 and kind4 from index1.&lt;/P&gt;

&lt;P&gt;If index2 exists already and you're wearing your rubber safety pants, you could try this :&lt;/P&gt;

&lt;OL&gt;
&lt;LI&gt;make a copy of index1 called index3&lt;/LI&gt;
&lt;LI&gt;delete everything but kind3 and kind4 from index3&lt;/LI&gt;
&lt;LI&gt;&lt;A href="http://splunk-base.splunk.com/answers/3795/can-i-merge-data-buckets-from-multiple-indexes-or-indexers"&gt;merge index3's buckets into index2&lt;/A&gt;&lt;/LI&gt;
&lt;LI&gt;delete index3&lt;/LI&gt;
&lt;LI&gt;deleting kind3 and kind4 from index1&lt;/LI&gt;
&lt;/OL&gt;

&lt;P&gt;It goes without saying, backup your indexes 1st, and please report back if it works : )&lt;/P&gt;

&lt;P&gt;You are going to waste a lot of space though, deleting data from an index doesn't free up space, it just marks it as deleted.&lt;/P&gt;</description>
    <pubDate>Fri, 23 Nov 2012 17:46:15 GMT</pubDate>
    <dc:creator>jonuwz</dc:creator>
    <dc:date>2012-11-23T17:46:15Z</dc:date>
    <item>
      <title>Move events from an index to another one</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Move-events-from-an-index-to-another-one/m-p/43511#M8123</link>
      <description>&lt;P&gt;Hello&lt;/P&gt;

&lt;P&gt;I search could i move sepcific data from an index called index1 to another one called index2.&lt;/P&gt;

&lt;P&gt;Let's say i have all this kind of events in my index 1 :&lt;BR /&gt;
Events kind 1&lt;BR /&gt;
Events kind 2&lt;BR /&gt;
Events kind 3&lt;BR /&gt;
Events kind 4&lt;/P&gt;

&lt;P&gt;I want to move all the events 3 &amp;amp; 4 to index index2 and delete them from index1.&lt;/P&gt;

&lt;P&gt;So the final result would be :&lt;BR /&gt;
Index1 :&lt;BR /&gt;
Events kind 1&lt;BR /&gt;
Events kind 2&lt;/P&gt;

&lt;P&gt;Index2 :&lt;BR /&gt;
Events kind 3&lt;BR /&gt;
Events kind 4&lt;/P&gt;

&lt;P&gt;Is there a way to do that ?&lt;/P&gt;

&lt;P&gt;Thanks.&lt;/P&gt;</description>
      <pubDate>Fri, 23 Nov 2012 09:05:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Move-events-from-an-index-to-another-one/m-p/43511#M8123</guid>
      <dc:creator>rbw78</dc:creator>
      <dc:date>2012-11-23T09:05:33Z</dc:date>
    </item>
    <item>
      <title>Re: Move events from an index to another one</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Move-events-from-an-index-to-another-one/m-p/43512#M8124</link>
      <description>&lt;P&gt;I'm guessing this is a 1 off and you don't have the raw data inputs anymore ?&lt;/P&gt;

&lt;P&gt;If thats true,&lt;/P&gt;

&lt;P&gt;If index2 does not exist already, by far the easiest solution would be to make a copy of index1 called index2, delete everything but kind3 and kind4 from index2, then delete kind3 and kind4 from index1.&lt;/P&gt;

&lt;P&gt;If index2 exists already and you're wearing your rubber safety pants, you could try this :&lt;/P&gt;

&lt;OL&gt;
&lt;LI&gt;make a copy of index1 called index3&lt;/LI&gt;
&lt;LI&gt;delete everything but kind3 and kind4 from index3&lt;/LI&gt;
&lt;LI&gt;&lt;A href="http://splunk-base.splunk.com/answers/3795/can-i-merge-data-buckets-from-multiple-indexes-or-indexers"&gt;merge index3's buckets into index2&lt;/A&gt;&lt;/LI&gt;
&lt;LI&gt;delete index3&lt;/LI&gt;
&lt;LI&gt;deleting kind3 and kind4 from index1&lt;/LI&gt;
&lt;/OL&gt;

&lt;P&gt;It goes without saying, backup your indexes 1st, and please report back if it works : )&lt;/P&gt;

&lt;P&gt;You are going to waste a lot of space though, deleting data from an index doesn't free up space, it just marks it as deleted.&lt;/P&gt;</description>
      <pubDate>Fri, 23 Nov 2012 17:46:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Move-events-from-an-index-to-another-one/m-p/43512#M8124</guid>
      <dc:creator>jonuwz</dc:creator>
      <dc:date>2012-11-23T17:46:15Z</dc:date>
    </item>
  </channel>
</rss>

