topic Re: I ran |delete on data. Why won't the forwarder resend? in Getting Data In

I ran |delete on data. Why won't the forwarder resend?

matstap — Fri, 01 Feb 2019 18:23:27 GMT

I ran |delete on some data (oops!). How do I get the universal forwarder to send the data to the indexers again?

Re: I ran |delete on data. Why won't the forwarder resend?

skoelpin — Fri, 01 Feb 2019 18:26:23 GMT

You need to clear the fishbucket out on the forwarder so it see's it as data it hasn't indexed yet. Option B would be to open the files and insert a single character near the top so it tricks the forwarder into thinking its a new file

https://www.splunk.com/blog/2008/08/14/what-is-this-fishbucket-thing.html

Re: I ran |delete on data. Why won't the forwarder resend?

chrisyounger — Fri, 01 Feb 2019 18:27:12 GMT

Look at the answer on this page: https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html (look at the second section). It is an excellent write-up of what you need to know.

This is probably what you need:

on a forwarder by removing the folder $SPLUNK_HOME/var/lib/splunk/fishbucket

or selectively forgot a single file from the fishbucket

splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset

good luck

Re: I ran |delete on data. Why won't the forwarder resend?

matstap — Fri, 01 Feb 2019 20:11:53 GMT

I stopped the forwarder, installed another universal forwarder and configured inputs.conf to monitor only the files I ran |delete on and that worked. I then uninstalled the new forwarder and restarted the old one.
I didn't want to clear the fishbucket because I didn't want ALL of the data to be re-ingested and for some reason the forwarder to forget the specific files wasn't working for me.
Maybe not the best solution, but it worked.