Hi,
in a past installation for a wrong choice indexed data are put in main/default index.
Now i would change index for my data and use a custom index, for example my_index.
How i can put data already indexed in this new index?
Thanks
You can use the "collect" command to copy the data from one index to the other (both indexes need to already exist). This, however, will leave a copy of the data in your main/default index. You will then need to use the "delete" command to get rid of the data you have transferred after you confirm that you have transferred it.
Link to the Q&A I gathered the info from: http://splunk-base.splunk.com/answers/34946/move-some-contentsource-from-one-index-to-another-index
Link to the Collect documentation: http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Collect
Link to the Delete documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete