Promoting new source from test index

davidbann — Thu, 09 Jan 2020 15:14:46 GMT

I'm adding a new input (UNC directory) and due to previous lessons learned, I took from best practice and sent events to a sandbox index while I fine tuned source types etc. Now I'm happy with the config and want to move the input to my "Production" index.

Other than modifying the source config to point to the new index, what do I need to do to have all the existing files reindexed to the new index? Previous attempts have only sent new events to the new index, Splunk seems to be avoiding duplicates, even across two indexes.

There is existing data in the new index that I don;t want to disturb, the sandbox index can be blown away if that matters.

Re: Promoting new source from test index

richgalloway — Thu, 09 Jan 2020 15:58:56 GMT

Splunk does not avoid duplicates, but it does avoid re-reading file data it's already read (a fine distinction). To force Splunk to re-index the files, you'll need to erase the "bookmarks" for those files. Use the btprobe command for that. Splunk must be stopped before running btprobe.

splunk stop
splunk btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file <filename> --reset 
splunk start

topic Re: Promoting new source from test index in Getting Data In

Promoting new source from test index

Re: Promoting new source from test index