Issues moving data from one index to another

[byu168]

I was attempting to move events from one index to another using this command

index=main host=gpm source=/var/log/gpm/gpm.log | collect index=gpm sourcetype=gpm

I checked the initial search to verify all the events I want are there, however, after running the entire command and checking index=gpm there are no events stored in it. gpm is a newly created index that has no events in it at all. Is there any reason that this issue is occurring?

[woodcock]

If you are moving 100% of the contents of the index, you can easily just rename it from the OS. You need to stop splunk, find the indexes.conf file that contains the current index definition, change the name of the index there, go find the directory on disk and change the name there, too, then restart splunk.

[byu168]

Thanks for the information! I was selectively moving data but this information could be useful in the future.

[byu168 · Accepted solution]

I wasn't able to figure out the cause of the issue, however, since the size of data I was moving was relatively small I found it easier to simply reindex the data

[ddrillic]

Another approach - Move data to another index based on _time