How can I move logs from one index to another?

[rharden]

We recently moved several different logs that were in the "main" index to a newly-created index in order to organize our data on our lun a little better. I'm wondering if there is a way to move data to another index, or if it is even possible to do so. I've seen other questions that were answered on this topic, but most of them seemed to have been on a much older version. We are currently running 6.3.3 and I'm wondering if there is a recommended way to do this currently.

[martin_mueller]

There is no general way of moving data from one index to another. Just let the data age out and continue with correct indexes from today on.

Alternatively, you could re-index the older data into the new index.

[martin_mueller]

Same way you originally indexed it.

Alternatively, you can manually load data something like this:

$SPLUNK_HOME/bin/splunk add oneshot path -index foo -host bar -sourcetype meh

Make sure to read ./splunk help add oneshot first.

[rharden]

Thanks for the answer;
How could I re-index the older data into a new index?