topic Re: splunk changes not reflecting in Getting Data In

splunk changes not reflecting

joydeep741 — Tue, 02 Aug 2016 13:40:20 GMT

I configured my server logs in splunk.
When I saw the logs in splunk I realized I set up some wrong properties in props.conf.

Now I rectify the properties in props.conf and restart server.

Somehow I still see the same logs on splunk front end, as they were before I rectified the issue in conf file.

Is there a way to know, if Splunk is picking logs from NEW INDEX ?
It seems it is picking logs from the index the got created the first time around.

Re: splunk changes not reflecting

richgalloway — Tue, 02 Aug 2016 13:51:08 GMT

Your changes will only affect new events. Anything indexed before you changed props.conf will continue to have the wrong properties. Are you sure you're looking at new data?

Re: splunk changes not reflecting

skoelpin — Tue, 02 Aug 2016 14:04:25 GMT

Since props.conf lives on the indexer, it means that if you make changes then it will only affect new data being indexed, so it will not work retroactively. The only way to make changes retroactively is at search time

To solve your problem, I would reccomend deleting the data from the index and reindexing the new data with the correct props.conf configuration

To remove data from the index

sourcetype=YOUR_SOURCETYPE | delete

To Reindex your new data

Do a oneshoot to reindex your data, go to your forwarder and to the splunk/bin folder

./splunk add oneshot /full/path/to/file -sourcetype mysourcetype -index myindex -host myhostparam