index change

[my_splunk]

Hi,
in a past installation for a wrong choice indexed data are put in main/default index.
Now i would change index for my data and use a custom index, for example my_index.
How i can put data already indexed in this new index?
Thanks

[aholzer]

You can use the "collect" command to copy the data from one index to the other (both indexes need to already exist). This, however, will leave a copy of the data in your main/default index. You will then need to use the "delete" command to get rid of the data you have transferred after you confirm that you have transferred it.

Link to the Q&A I gathered the info from: http://splunk-base.splunk.com/answers/34946/move-some-contentsource-from-one-index-to-another-index

Link to the Collect documentation: http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Collect

Link to the Delete documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete