How to move index from main to custom index?

[test_qweqwe]

Hello
I failed and miss index for nginx and all logs saved to main.

Now I created new index "nginx_logs" and how me move all nginx logs from "main" to my new index "nginx_logs"?

[woodcock · Accepted solution]

You can only move all of them or none of them. Here is the process to move EVERYTHING from index=main to NEW index=nginx:

On the forwarders, stop the Splunk instances so that they will not be sending ANYTHING to the Indexer(s). Update the inputs.conf so that your stuff is going to go to the new index when you start Splunk there.

On each indexer:
/opt/splunk/bin/splunk stop
Update /opt/splunk/etc/apps/*/indexes.conf to add the new nginx index.
cd /opt/splunk/var/lib/splunk/
mv -f main.dat nginx.dat
mv -f defaultdb nginx
/opt/splunk/bin/splunk start

When Splunk starts, it will create a new main index that is empty. Restart Splunk on the forwarder so it starts sending to the new index.