https://community.splunk.com/t5/Getting-Data-In/Can-I-linebreak-indexed-data-that-s-not-correctly-linebroken/m-p/12739#M1020 <P>I have seen manytime where Splunk didn't copped either multi or single line data correctly ending up with events that are 200-300 lines long. In this case, do I have to re-index those data after deleting or can I chop the data that's already indexed in Splunk's index?</P> Sat, 01 May 2010 21:22:05 GMT clyde772 2010-05-01T21:22:05Z https://community.splunk.com/t5/Getting-Data-In/Can-I-linebreak-indexed-data-that-s-not-correctly-linebroken/m-p/12739#M1020 <P>I have seen manytime where Splunk didn't copped either multi or single line data correctly ending up with events that are 200-300 lines long. In this case, do I have to re-index those data after deleting or can I chop the data that's already indexed in Splunk's index?</P> Sat, 01 May 2010 21:22:05 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-linebreak-indexed-data-that-s-not-correctly-linebroken/m-p/12739#M1020 clyde772 2010-05-01T21:22:05Z https://community.splunk.com/t5/Getting-Data-In/Can-I-linebreak-indexed-data-that-s-not-correctly-linebroken/m-p/12740#M1021 <P>Once the event has been indexed, about all you can do with it is delete it and reload it. When setting up new data sources, I always feed them into a "testdata" index for a few days until I see that I have my line breaks and such set up right. That way, it's easy enough to just delete that whole index instead of having to use the "delete" search operator -- which takes a lot longer.</P> Sat, 01 May 2010 21:52:18 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-linebreak-indexed-data-that-s-not-correctly-linebroken/m-p/12740#M1021 dwaddle 2010-05-01T21:52:18Z