Can I Index Data Not Previously Indexed

[rgcurry]

I have a user who has collected data from his servers that was indexed by Splunk using the "main" index. Now he wants to create his own, app-specific index. Can we index the data he has already collected to use this new index?

[kristian_kolb · Accepted solution]

No, data can not be moved from one index to another. Of course you could re-index it into the new index (if the data is still on file somewhere), and remove it from the main index. Well, you cannot really remove it from main, but you can make it 'invisible' so that it never shows up as the result of a search.

Search this forum for 'delete' to learn more on how this works.

/kristian