Single Index (Historic Data) & Splunk Apps

[gdavid]

I have a single index that has just been collecting data for months now. I want to use some splunk apps now (citrix / active directory / cisco) . How can i accomplish this?

is the best plan of attack to export the data into the new databases? (how do i do that?)

thanks in advance

gd

[gdavid]

My end goal was to reindex the data for cisco security app.

i ended up running a query for my cisco hosts.
i export to raw

then imported using
splunk.exe add oneshot d:\gdtest.raw -host myHostIP -rename-source udp:514

[vincesesto]

Not sure what the easy way to resolve this issue would be, but I would guess you could either, change the app to point to your old data as well as your new data or use the collect command to move the data into the newly created app index

eg:

index=oldindex

| collect index=newindex

The information you search for will then be piped into the index you need

http://docs.splunk.com/Documentation/Splunk/latest/searchreference/collect

Not sure if there is a better resolution to this

[gdavid]

sorry i'm new to splunk and its terminology.

i have an existing splunk instance with a single index that has all my data.
i have a new separate installation with 2 indexers and 1 search head.

i've installed the citrix xendesktop/xenapp apps and i noticed how it auto created specific indexes. I just assumed that in order to use the different apps the data had to be in the specific indexes.

[vincesesto]

Hey gd,
I am not sure what you mean by exporting the data into new databases...With regards to using the splunk app, have you installed them yet and if so, is there no data displaying(Is this the issue you are facing?)
Regards, Vince