topic Clean Forwarder fishbuckets for one sourcetype in Getting Data In

Clean Forwarder fishbuckets for one sourcetype

robertlynch2020 — Tue, 26 Oct 2021 16:15:24 GMT

Hi - I have a command to clean fish buckets in a forwarder - if i want to take back in data for testing etc...

cd var/lib/splunk/
rm -r fishbucket/
bin/splunk stop; cd var/lib/splunk/ ; rm -r fishbucket/ ;cd - ; rm -r var/ ; bin/splunk start

But is there any way to clean fish buckets for only one source type?

isoutamo — Tue, 02 Nov 2021 21:48:55 GMT

splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset

Before that you must stop Splunk on that node.

r. Ismo