You have a couple of ways to implement this.
To answer your initial question, yes, you could use summary indexing to copy (not move) events from one index into another. That is not the original intent of summary indexing, but you could certainly have a scheduled search pick out the events you want to expose to your help desk and "summarize" them into another index. That would work best if you had a small number of events that you wanted to expose.
http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Usesummaryindexing
Another option would be to create the dashboard using saved searches, and have those searches run as the owner, who has access to the index. Then your users can access the dashboard, view the results of the search without needing access to the underlying index.
See the section "Determine whether the search should run as Owner or run as User" in the following link:
http://docs.splunk.com/Documentation/Splunk/latest/Report/Createandeditreports
You can also restrict your user's access by adding a search expression to their role. This will allow you to give them access to the wineventlog index, but they effectively would only be able to see certain events as specified by the role search expression.
https://docs.splunk.com/Splexicon:Searchfilter
... View more
