https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122485#M25354 <P>Hi felix_fxm,</P> <P>using the <CODE>delete</CODE> command will not remove the events, there are only hidden from search. Also, Splunk will not forget about this already indexed file.</P> <P>If this is a test setup and you're just starting, use the <CODE>splunk clean all</CODE> command which will remove the events and also clean up the so called <CODE>_fishbucket</CODE> this is where splunk keeps track of already indexed files.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Fri, 12 Sep 2014 10:19:40 GMT MuS 2014-09-12T10:19:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122483#M25352 <P>I indexed some data into splunk by .csv file, but there is some problem with it. So I removed them by "|delete" command. Now I want to re-index them, and hope splunk can update the data if the original file is updated. <BR /> Then I added data file successfully, but the items are not indexed to splunk, do you know how to make it?</P> Fri, 12 Sep 2014 10:01:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122483#M25352 felix_fxm 2014-09-12T10:01:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122484#M25353 <P>Splunk isn't indexing the file because it thinks it already has.</P> <P><A href="http://docs.splunk.com/Documentation/Storm/Storm/User/Editinputsconf">You need to edit inputs.conf with a CRC salt so the hash splunk makes upon indexing files is changed.</A></P> <BLOCKQUOTE> <P><CODE>crcSalt = &lt;source&gt;</CODE></P> </BLOCKQUOTE> <P>Adding that under the stanza where you've identified the specific input will change the hash sufficiently that splunk will re-index. Once you make that change and restart splunk it should pick it back up again to be indexed.</P> Fri, 12 Sep 2014 10:19:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122484#M25353 rgonzale6 2014-09-12T10:19:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122485#M25354 <P>Hi felix_fxm,</P> <P>using the <CODE>delete</CODE> command will not remove the events, there are only hidden from search. Also, Splunk will not forget about this already indexed file.</P> <P>If this is a test setup and you're just starting, use the <CODE>splunk clean all</CODE> command which will remove the events and also clean up the so called <CODE>_fishbucket</CODE> this is where splunk keeps track of already indexed files.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Fri, 12 Sep 2014 10:19:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122485#M25354 MuS 2014-09-12T10:19:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122486#M25355 <P>there are multiple files with the same name, on my win machine I modified C:\Program Files\Splunk\etc\system\local\inputs.conf</P> Tue, 17 Mar 2015 05:30:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122486#M25355 mzq 2015-03-17T05:30:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122487#M25356 <P>splunk can not update the file, it just re-index the new file.<BR /> for your problem, you have two options<BR /> 1. create a new index and recharge your .csv file inside<BR /> 2. you either delete this file using the <CODE>splunk clean</CODE> command and then reload you again your file<BR /> let me know if this helps.</P> Tue, 17 Mar 2015 09:25:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-re-index-the-deleted-data-in-splunk/m-p/122487#M25356 gyslainlatsa 2015-03-17T09:25:53Z