topic Re: After removing data using the delete command in a search, how do I reindex that data? in Getting Data In

After removing data using the delete command in a search, how do I reindex that data?

sunnyparmar — Mon, 20 Jul 2015 11:31:38 GMT

Hi,

I have one delimited tab log file with a .txt extension. I pushed the data from from that log file to the Splunk server, but for some R&D purposes, I have deleted some particular supplier rows from that file with the search:

index=sand_box sourcetype="sc-kofax-extracts" <supplier name> | delete

Now, I want that particular supplier data again in Splunk and for that, I have restarted my splunk forwarder services many times so that it can push data to the Splunk server, though it is not able to do so. Still i am not able to get data for that particular supplier on the Splunk server so please anybody guide me how to retrieve the data for that particular supplier again.

Thanks
Ankit

Re: After removing data using the delete command in a search, how do I reindex that data?

woodcock — Mon, 20 Jul 2015 16:39:04 GMT

You need to clear the fishbucket or use oneshot to force it in; read full details here:

http://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html

Re: After removing data using the delete command in a search, how do I reindex that data?

sunnyparmar — Tue, 21 Jul 2015 10:01:42 GMT

Hi,

thanks for replying.. how feasible it is if i am clearing the fishbucket index.. Is it remove all index structure related to my old data?

Thanks & Regards
Ankit

Re: After removing data using the delete command in a search, how do I reindex that data?

woodcock — Fri, 24 Jul 2015 16:24:25 GMT

If you mean get your disk space back, forget about it. If you mean use new configuration files, just deploy the updates before you clear it. If you mean something else, you need to be much more clear. Don't forget to "Accept" to close the question.