Getting Data In

Can I Index Data Not Previously Indexed

Contributor

I have a user who has collected data from his servers that was indexed by Splunk using the "main" index. Now he wants to create his own, app-specific index. Can we index the data he has already collected to use this new index?

Tags (2)
0 Karma
1 Solution

Ultra Champion

No, data can not be moved from one index to another. Of course you could re-index it into the new index (if the data is still on file somewhere), and remove it from the main index. Well, you cannot really remove it from main, but you can make it 'invisible' so that it never shows up as the result of a search.

Search this forum for 'delete' to learn more on how this works.

/kristian

View solution in original post

0 Karma

Ultra Champion

No, data can not be moved from one index to another. Of course you could re-index it into the new index (if the data is still on file somewhere), and remove it from the main index. Well, you cannot really remove it from main, but you can make it 'invisible' so that it never shows up as the result of a search.

Search this forum for 'delete' to learn more on how this works.

/kristian

View solution in original post

0 Karma