Transfering data from one index to another

[linu1988]

Hello Everyone,
Is there any functionality in splunk to tranfer event from one to other index source/sourcetype wise? It would help with negating rework/data loss.

Thanks

[lguinn2]

Sorry. The only thing you can do is to find the original data and export it to a flat file, and then re-index it as desired. I don't think this is what you wanted, but AFAIK there is no way to transfer data from one index to another.

[linu1988]

No this is not what i want or many want. This would be another hottest release for future splunk release with some more enhancement which i think is not at all good and requires so much effort for simple things.

Btw like always love to hear from you Guru's, Learn so much just from reading your comments

[lguinn2]

This is not necessarily easy or desirable for Splunk - as Splunk is not a DBMS.