Migrate data from one index to another index

[bzsplunk54]

Hello
I am looking to see if its possible to migrate (point) data from one index that is currently under the search application to a custom application. I believe that I would need to create another index and set this up under the custom application? Then migrate or point the data to the new index? Currently I have an index that is under the etc/apps/search/local/indexes.conf file and I am need this to be under the /etc/apps/my_custom_index/local indexes.conf. Looking for some recommendations. thank you.

[koshyk]

Your understanding of indexes is incorrect.
Index is NOT restricted at app level.

So inorder to fix your issue
1. Stop splunk
2. Create an app e.g. my_custom_indexes_app => mkdir -p /opt/splunk/etc/apps/my_custom_indexes_app/local
3. mv /opt/splunk/etc/search/local/indexes.conf /opt/splunk/etc/apps/my_custom_indexes_app/local/indexes.conf
4. Start splunk

[bzsplunk54]

Mistype - above. Corrected below
Hello
I am looking to see if its possible to migrate (point) data from one index that is currently under the search application to a custom application. I believe that I would need to create another index and set this up under the custom application? Then migrate or point the data to the new index? Currently I have an index that is under the etc/apps/search/local/indexes.conf file and I am need this to be under the /etc/apps/my_custom_index/local indexes.conf. Looking for some recommendations. thank you.

[skalliger]

Hi,

I have updated your post. You can also edit your postings yourself. Just a reminder when you'll have a question again. 🙂

An index is not bound to an app. You can simply move the definition there from system/local to
/etc/apps/your_app/.

Skalli