topic Re: Data not found after indexing in Getting Data In

Data not found after indexing

abhayneilam — Wed, 19 Dec 2012 06:16:31 GMT

I had made an application called "XYX" and kept it in .../app directory, it was working fine but suddenly applied this command in search box in search application :

index="myindex_name" | delete

and then I restarted my SPLUNK tool after that when I am trying to access data through "XYX" application I dont find any data , but I have providing my data as :

[monitor://$SPLUNK_HOME\etc\apps\Abhay-SECOP\logs\ANZ*Mail*.txt]

file is there in the Directory ANZ but still I am not able to see anything ..

please help me regarding this ...

Re: Data not found after indexing

MuS — Wed, 19 Dec 2012 08:10:04 GMT

Hi adhayneilam

index="myindex_name" | delete

this command will remove your events from index=myindex for all searches, so you will not be able to find them again. If your apps is based on that index, you will not get an event back.

read more about the delete command here

cheers,

MuS

Re: Data not found after indexing

Drainy — Wed, 19 Dec 2012 08:13:04 GMT

I love how it "suddenly applied this command" 😉 Splunk is well known for adding the can delete role to a user and then appending the delete command to the end of a search string! Seriously though, what MuS says below is right. You'll need to do some fishbucket cleaning to get the data back again.

EDIT: Read here for more detail on the fishbucket;
http://splunk-base.splunk.com/answers/66927/no-longer-seeing-all-logs-after-clearing-index

Re: Data not found after indexing

abhayneilam — Mon, 28 Sep 2020 12:59:26 GMT

Hi Drainy,

I gave the following command and got this :

splunk clean eventdata _fishbucket

This action will permanently erase all events from the index '_fishbucket'; it c
annot be undone.
Are you sure you want to continue [y/n]? y
ERROR: Index '_fishbucket' does not exist.

Please let me know how to get it solved !!

Re: Data not found after indexing

Drainy — Wed, 19 Dec 2012 10:25:31 GMT

Have a full read of the link I pasted above, it covers this 🙂

Re: Data not found after indexing

Drainy — Wed, 19 Dec 2012 11:32:05 GMT

Oh and it might be an idea to remove the can delete role and only add it as and when you need it. No need to keep it on all the time, especially if accidents like this happen 🙂

Re: Data not found after indexing

jonuwz — Wed, 19 Dec 2012 12:01:27 GMT

speak to your storage team and get them to restore /opt/splunk/var/lib/splunk/<name of the index you wiped>

you wiped your index clean

Re: Data not found after indexing

dgililo — Mon, 28 Sep 2020 14:51:41 GMT

We run SPLUNK in test and dev environment to test parsing logic before moved to production monitoring. so need to reset Heavy Forwarder to index from scratch once parsing logic has been updated.

On the heavy forwarder i am trying to use

$ ./splunk clean eventdata -index fishbucket This action will permanently erase all events from the index 'fishbucket'; it cannot be undone. Are you sure you want to continue [y/n]? y ERROR: Index 'fishbucket' does not exist. [ebstsf-17] /app/splunk/bin $ ./splunk clean eventdata _fishbucket This action will permanently erase all events from the index 'fishbucket'; it cannot be undone. Are you sure you want to continue [y/n]? y ERROR: Index '_fishbucket' does not exist. [ebstsf-17] /app/splunk/bin $ cd ../var/lib/

Both commands throw ERROR: Index '_fishbucket' does not exist.

please help