Migrating data from main index to new index in splunk cloud

[rajiv_r]

I have pushed all my sourcetype in the main index since it was streaming through single app. Now i required to move the data from main index to a new index and i am using splunk cloud instance. So can anyone please help in migrating the data from main index to the new index in splunk cloud instance

[anmolpatel]

@rajiv_r have you seen the below ?
https://answers.splunk.com/answers/709334/how-do-i-move-data-from-one-index-to-another.html

[rajiv_r]

Yes anmol, i have already seen those links. It dint help me as all of them have given the guidelines for the splunk enterprise version not for the splunk self service cloud deployment. Splunk cloud deployment does not have an access to the folder structure to copy and paste the main index data to the new index.

[anmolpatel]

@rajiv_r apologies, i missed the tag. As per the Splunk docs, user doesn't have the permission to migrate or move indexes:
https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/User/ManageIndexes

you would want to raise a Support ticket for that if you want to move all data.

Alternatively, if you want to push some data across to a new index, you can create the new index and use the collect command. This will put the data into the summary index.