topic Re: Unable to re-index all data in Getting Data In

Unable to re-index all data

Deecie — Wed, 18 Apr 2012 00:40:43 GMT

I'm trying to re-index some old data now that I've changed what index it goes into and

The data comes in from a UF that monitors two files.

These are the steps I took:

Stopped the forwarder
Ran this on the indexer:

* | DELETE

ran this on the forwarder; my understanding is that it should clear the _fishbucket index:

splunk clean all

made my config changes
started the forwarder

I'm now seeing data come correctly into the new index with the new source types, but there's no retrospective data - only new incoming data. Anyone know what I might be doing wrong?

Re: Unable to re-index all data

cramasta — Wed, 18 Apr 2012 20:29:31 GMT

does each event in your log file have a timestamp?

Re: Unable to re-index all data

Deecie — Thu, 19 Apr 2012 00:45:02 GMT

Yep, every line.

Re: Unable to re-index all data

araitz — Thu, 19 Apr 2012 03:46:31 GMT

Did your resolution for your other issue solve this problem as well?

Re: Unable to re-index all data

Deecie — Thu, 19 Apr 2012 06:39:21 GMT

Unfortunately not. All the data I index has the indexing date as its time stamp. I've tried setting up a props.conf entry to specify the timestamp format for this sourcetype but it had no effect.

Re: Unable to re-index all data

neelamssantosh — Wed, 17 Sep 2014 08:19:38 GMT

We can re-index the data by modifying first line of the log file with some comments.
eg: #Re-index
so that crcSalt doen't match with other files and it re-indexes your data.

Hope it can help you.
All the best