topic Deleting an Index from the fish bucket in Getting Data In

Deleting an Index from the fish bucket

Dark_Ichigo — Wed, 07 Dec 2011 01:30:02 GMT

I want to find an index I created and remove it completely from Splunk, so I can re-use the same name, How can this be done?

Re: Deleting an Index from the fish bucket

_d_ — Wed, 07 Dec 2011 03:28:54 GMT

To remove an index, stop the splunk service and do the following from the command line:

./splunk clean eventdata -index <index_name>

Note: This will completely delete the data in the specified index and is irreversible!

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

Re: Deleting an Index from the fish bucket

Dark_Ichigo — Wed, 07 Dec 2011 03:41:26 GMT

Nope this isnt useful, I do need to mention that when clearing event data, I cannot re-index the same files to that index, unless I change the index name!

What I want is to Completely remove the index from Splunk!.....basically from the Fishbucket in order to re-index my logs.

So how can I do this?

Re: Deleting an Index from the fish bucket

_d_ — Wed, 07 Dec 2011 03:49:31 GMT

This will clean the ENTIRE fishbucket:

./splunk clean eventdata _thefishbucket

Not sure how to clean select or partial data from fishbucket.

Re: Deleting an Index from the fish bucket

Dark_Ichigo — Mon, 28 Sep 2020 10:11:36 GMT

This is What I need, although I do not want to delete the whole fishbucket, would it be possible to use this following command to remove a particular index from the Fishbucket:

./splunk clean eventdata _fishbucket -index

If there was, this would defiantly solve a great number of issues im having!

Re: Deleting an Index from the fish bucket

twkan — Wed, 07 Dec 2011 15:06:25 GMT

If you want to reindex the same files again, you can take a look at the 'oneshot' command. Another way I could think of is to install a temporary forwarder to re-index those files before forwarding them out to the current instance. Since this temporary forwarder will have a new fishbucket, it wouldn't know the files have already been indexed before and you can achieve the re-indexing without clearing the existing fishbucket on your instance.

Re: Deleting an Index from the fish bucket

Jason — Wed, 09 Jan 2013 14:49:24 GMT

Another way to force re-indexing of already-indexed files is to add a crcSalt to the particular input in inputs.conf. Any file that was found by the input would then get a modified hash in the fishbucket and would be re-read.

[monitor:///some/awesome/stuff]
sourcetype = best_to_have_one
blacklist = \.if_necessary$
crcSalt = readItAgain

You could run a search for | metadata type=sources index=bad to pull a list of all the files you need to find, then add a crcSalt to those input stanzas in inputs.conf.

This may help too, using btprobe: http://splunk-base.splunk.com/answers/54070/btprobe-and-re-indexing-data/66208

Re: Deleting an Index from the fish bucket

wrangler2x — Thu, 24 Jan 2013 21:25:36 GMT

This worked hot-damn!

I had some syslog data that went into a wrong index. After fixing that problem, I used a command line search to get the raw records, and used the manager to create a one-time input for the file created from that. Did not index! Fishbucket! So I ran across this and created a batch input for the desired index (sinkhole type) and added the crcSalt = readItAgain and after splunk restarted the file was gone and the data was indexed where it ought to be. Excellent!

Re: Deleting an Index from the fish bucket

wrangler2x — Thu, 27 Mar 2014 15:44:22 GMT

There is an explanation of how to do a partial cleaning of t he fishbucket here: http://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder

Re: Deleting an Index from the fish bucket

parth_panchal — Thu, 04 Feb 2021 05:34:22 GMT

Hi @_d_, ./splunk clean eventdata _thefishbucket is wrong command it will delete all data from all indexes in Splunk instance. Please use ./splunk clean eventdata -index _thefishbucket to clean the fishbucket only.