topic Re: delete and create same index, data does not index in Getting Data In

delete and create same index, data does not index

SplunkCSIT — Tue, 01 Apr 2014 03:23:41 GMT

Due to some error, i had deleted the test123 indexes at indexer, restart the indexer, create the test123 again. But somehow the data does not index anymore?

Re: delete and create same index, data does not index

HiroshiSatoh — Tue, 01 Apr 2014 04:02:51 GMT

Once captured logs will not be indexed. A new log is indexed.
New log is also not indexed?

Re: delete and create same index, data does not index

MuS — Tue, 01 Apr 2014 06:43:14 GMT

Hi SplunkCSIT,

Splunk keeps track of what was indexed and therefor does not re-index the same data again .... unless you do some work.

The radical method is to clean the fishbucket index. That will remove the memory of every files, be warned it will re-index all data.

on an indexer splunk clean eventdata -index _fishbucket
on a forwarder by removing the folder $SPLUNK_HOME/var/lib/splunk/fishbucket

You could selectively forgot a single file from the fish bucket like this:

splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset

You could manually re-index each file with the oneshot option

splunk add oneshot "/path/to/my/file.log" -sourcetype mysourcetype

You could modify the first line of the files to re-index, by default Splunk checks the first 256 chars of a file to differentiate them. If you had a simple comment on the first line it wil reindex it

You could change the crcSalt, create a new input for a new folder, add all the correct sourcetypes, etc... add the option crcSalt=<SOURCE> then move or copy the files to be re-index to the folder.

hope this helps ...

cheers, MuS

Re: delete and create same index, data does not index

SplunkCSIT — Tue, 01 Apr 2014 09:07:19 GMT

I had deleted the indexes, if there a way to retrieve back instead of re-index each file manaully as i got more than 10000 of files? thks

Re: delete and create same index, data does not index

MuS — Tue, 01 Apr 2014 09:10:27 GMT

if your files will be read by an universal forwarder, than your forwarder fishbucket must be cleaned as well, after that your files will be re-indexed

Re: delete and create same index, data does not index

SplunkCSIT — Tue, 01 Apr 2014 09:39:07 GMT

I got alot of indexes but i only want to remove one particular indexes, what will be the steps, thks a lot for assistance.