https://community.splunk.com/t5/Security/How-do-i-re-ingest-data-from-a-particular-source/m-p/668803#M17386 <P>A common way to re-ingest data is by using the <FONT face="courier new,courier">splunk add oneshot</FONT> command.&nbsp; Splunk will re-ingest everything in the file, however, without regard to events that were previously indexed.&nbsp; To ingest only missing events, I would copy the file and remove the events that you don't want to read in again.</P> Thu, 16 Nov 2023 00:35:48 GMT richgalloway 2023-11-16T00:35:48Z https://community.splunk.com/t5/Security/How-do-i-re-ingest-data-from-a-particular-source/m-p/668767#M17381 <P>I had a missing data from a certain date and time range. How would i re-ingest the data into splunk from a UF.</P> <P>&nbsp;</P> <P>Below is the inputs.conf</P> <LI-CODE lang="markup">[monitor:///app/java/servers/app/log/app.log.2023-11-12] index = app_logs ignoreOlderThan = 10d disabled = false sourcetype = javalogs</LI-CODE> <P>Its missing data from Nov-11 00:05 till Nov-12 13:00 so how would i just reinject the data only for that certain data/time period.<BR /><BR />It just one log file for a day although we have some events so how would i regest only the missing data for the time period and please let me know the config.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sathiyasun_1-1700066977105.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/28134i370CFA185AD22C5B/image-size/medium?v=v2&amp;px=400" role="button" title="sathiyasun_1-1700066977105.png" alt="sathiyasun_1-1700066977105.png" /></span></P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sathiyasun_0-1700066609304.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/28133i0682A545387826F8/image-size/medium?v=v2&amp;px=400" role="button" title="sathiyasun_0-1700066609304.png" alt="sathiyasun_0-1700066609304.png" /></span></P> <P>&nbsp;</P> Wed, 15 Nov 2023 16:58:37 GMT https://community.splunk.com/t5/Security/How-do-i-re-ingest-data-from-a-particular-source/m-p/668767#M17381 sathiyasun 2023-11-15T16:58:37Z https://community.splunk.com/t5/Security/How-do-i-re-ingest-data-from-a-particular-source/m-p/668803#M17386 <P>A common way to re-ingest data is by using the <FONT face="courier new,courier">splunk add oneshot</FONT> command.&nbsp; Splunk will re-ingest everything in the file, however, without regard to events that were previously indexed.&nbsp; To ingest only missing events, I would copy the file and remove the events that you don't want to read in again.</P> Thu, 16 Nov 2023 00:35:48 GMT https://community.splunk.com/t5/Security/How-do-i-re-ingest-data-from-a-particular-source/m-p/668803#M17386 richgalloway 2023-11-16T00:35:48Z