Deployment Architecture

index change

my_splunk
Path Finder

Hi,
in a past installation for a wrong choice indexed data are put in main/default index.
Now i would change index for my data and use a custom index, for example my_index.
How i can put data already indexed in this new index?
Thanks

Tags (1)
0 Karma

aholzer
Motivator

You can use the "collect" command to copy the data from one index to the other (both indexes need to already exist). This, however, will leave a copy of the data in your main/default index. You will then need to use the "delete" command to get rid of the data you have transferred after you confirm that you have transferred it.

Link to the Q&A I gathered the info from: http://splunk-base.splunk.com/answers/34946/move-some-contentsource-from-one-index-to-another-index

Link to the Collect documentation: http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Collect

Link to the Delete documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...