https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261200#M50114 <P>How about just renaming the files to something else? Since the crc Handler includes the file name, updating the file name in any way would cause it to re-index the data.</P> <P>Other option would be to copy to files to be re-indexed to some different folder and use new monitoring stanza with same index/sourcetype/crcSalt.</P> Thu, 26 Jan 2017 15:15:28 GMT somesoni2 2017-01-26T15:15:28Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261199#M50113 <P>I have a data input which uses </P> <PRE><CODE>crcSalt = &lt;SOURCE&gt; </CODE></PRE> <P>Task is to reindex these data. Preferably using the crcSalt optione (see <A href="https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html">How to reindex data from a forwarder</A>)</P> <P>I already tested</P> <PRE><CODE>crcSalt = REINDEXME&lt;SOURCE&gt; </CODE></PRE> <P>but of course it doesn't work.</P> <P>Any idea - except from "modify the first line of the files to reindex" or "clean the fishbucket"?</P> Thu, 26 Jan 2017 14:37:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261199#M50113 mlorch 2017-01-26T14:37:06Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261200#M50114 <P>How about just renaming the files to something else? Since the crc Handler includes the file name, updating the file name in any way would cause it to re-index the data.</P> <P>Other option would be to copy to files to be re-indexed to some different folder and use new monitoring stanza with same index/sourcetype/crcSalt.</P> Thu, 26 Jan 2017 15:15:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261200#M50114 somesoni2 2017-01-26T15:15:28Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261201#M50115 <P>Hi somesoni2,<BR /> I have no access to the source. Anyway: We will mount the source path to another server. This "new" forwarder doesn't know these files by now. Providing it the configuration together with a "ignoreOlderThan" should do the trick.<BR /> Thanks!</P> Thu, 26 Jan 2017 17:04:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261201#M50115 mlorch 2017-01-26T17:04:06Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261202#M50116 <P>Hi mlorch,<BR /> You have to cut from your row REINDEXME.<BR /> Bye.<BR /> Giuseppe </P> Thu, 26 Jan 2017 17:08:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261202#M50116 gcusello 2017-01-26T17:08:05Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261203#M50117 <P>That should just work fine. You can convert your comment above as Answer (mouse hover shows 'More' options, 2nd last) and accept it, so that others can benefit for your solution.</P> Thu, 26 Jan 2017 17:51:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261203#M50117 somesoni2 2017-01-26T17:51:25Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261204#M50118 <P>Hi Giuseppe,<BR /> misunderstanding: For this stanza I already have </P> <PRE><CODE>crcSalt = &lt;SOURCE&gt; </CODE></PRE> <P>To reindex I usually use something like </P> <PRE><CODE>crcSalt = REINDEXME01 </CODE></PRE> <P>So from technical point of view it should be possible to combine both options, path and string. But this option seems not to be implemented.</P> Fri, 27 Jan 2017 12:28:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-reindex-data-with-change-of-crcSalt-if-crcSalt-is-used/m-p/261204#M50118 mlorch 2017-01-27T12:28:32Z