https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228237#M44468 <P>Looks like a new deployed was created that monitored the IIS log location and the old deployed app was removed. </P> <P>Would that cause Splunk to re-index? I thought that data was separate from the app.</P> Thu, 12 Jan 2017 19:04:44 GMT Nahra 2017-01-12T19:04:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228234#M44465 <P>Recently, my Splunk environment decided to re-index ALL of my IIS logs (which crushed my daily license quota). I have been tasked with finding the root cause of why that happened.</P> <P>Is there anyway to find in the Splunk logs why it decided to re-index all these logs?</P> Thu, 12 Jan 2017 17:37:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228234#M44465 Nahra 2017-01-12T17:37:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228235#M44466 <P>Search <CODE>index=_internal host=an_iis_forwarder NOT component="Metrics"</CODE> for clues around the time of the reindex.</P> Thu, 12 Jan 2017 17:51:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228235#M44466 martin_mueller 2017-01-12T17:51:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228236#M44467 <P>A place to start would be to look at timestamps on your fishbucket.. Fishbucket is responsible for keeping pointers of what's been indexed, so this would be a reasonable assumption to check </P> Thu, 12 Jan 2017 18:13:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228236#M44467 skoelpin 2017-01-12T18:13:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228237#M44468 <P>Looks like a new deployed was created that monitored the IIS log location and the old deployed app was removed. </P> <P>Would that cause Splunk to re-index? I thought that data was separate from the app.</P> Thu, 12 Jan 2017 19:04:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228237#M44468 Nahra 2017-01-12T19:04:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228238#M44469 <P>It would. Once the old app was removed, it will clear Splunk's monitoring list/_fishbucket which tracks the files being monitored (and till what point it has monitored the log file). When the new app was deployed, Splunk will treat that a new data monitoring and will read the file from start and can cause duplicates.</P> Thu, 12 Jan 2017 19:23:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228238#M44469 somesoni2 2017-01-12T19:23:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228239#M44470 <P>Usually not, but it depends on the old and new input configuration.</P> Thu, 12 Jan 2017 22:13:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-out-why-Splunk-Indexer-re-indexed-my-IIS-logs/m-p/228239#M44470 martin_mueller 2017-01-12T22:13:09Z