An index was not prepared to ingest data, so I cannot see events from previous days. How do I fix this?

[TheJagoff]

Hello,

I forgot to have an index ready when I started to ingest data (log file with data from last week to present) from a Universal Forwarder to my indexer. I saw the message warning me of this, so I created the index and the only data that is appearing in the new index and verified via searching is the data from today. The data is timestamped with date/time after I created the index and it is producing the interesting fields and line breaking correctly with good timestamps.

The data from the previous days isn't coming through.

So the question is; How can I fix this for this index only?

Many thanks.

[skoelpin · Accepted solution]

It will automatically go to your main index. So go look in index=main and sort by the source to see your files.

How much data did you have in your main index before this data came in?

If a lot then you have a problem.. A few option here

1) Temporarily taylor your searches to account for both indexes and narrow down on your source
2) If the data is still on your logfiles, you could easily reindex them by clearing the fishbucket
3) Deal with losing a few days worth of data
4) Manually moving the data from your main index into your new index

Option 4 is tricky and will require some Splunk knowledge. I just posted a solution to how to do this exact thing the other day

https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html

[TheJagoff]

Yep, it's there in main. We will tailor our searches accordingly. Thank you!