Do you need to export the old and already indexed logs and move them to the new system? Then you can do an export of the old data via: index="your-index" | table _raw | outputcsv old_records.csv Or you can dump to disk using dump basefilename= [rollsize=] [compress=] [format=] [fields=] Look for "Export data using the dump command" on docs.splunk ... View more