We used to use splunk in a very, very slow and old machine and we have about 9 years of logs on that machine.
We recently moved to a much much nicer 6 server cluster and want to decommission the old machine but do not want to lose those logs.
How can we move the data from the old setup into the new? The smart thing may have been to move it BEFORE powering up the new setup but we did not do that, so now the past 3 months of logs are indexed and stored in the new setup while the old setup has years of data from before that turn on date/
Upgrade the old server to v6, then copy the buckets over to the new server.
This wiki post might help (see the advanced section, since you have existing buckets): http://wiki.splunk.com/Community:MoveIndexes