https://community.splunk.com/t5/Getting-Data-In/How-to-undelete-a-input-source/m-p/46568#M8802 <P>I have a log file that was <CODE>|delete</CODE>'d from the index using search. I want the file back in the index. I did several steps of adding and removing the file as a Splunk input and restarting the machine's splunk. It just won't come back. Is there an easy way to <CODE>|undelete</CODE>?</P> Thu, 09 Sep 2010 05:22:47 GMT splukUP 2010-09-09T05:22:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-undelete-a-input-source/m-p/46568#M8802 <P>I have a log file that was <CODE>|delete</CODE>'d from the index using search. I want the file back in the index. I did several steps of adding and removing the file as a Splunk input and restarting the machine's splunk. It just won't come back. Is there an easy way to <CODE>|undelete</CODE>?</P> Thu, 09 Sep 2010 05:22:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-undelete-a-input-source/m-p/46568#M8802 splukUP 2010-09-09T05:22:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-undelete-a-input-source/m-p/46569#M8803 <P>There is no way to <CODE>undelete</CODE> the data. If you still have the original data, you can reindex the file with the Splunk <CODE>oneshot</CODE> command, examples <A href="http://answers.splunk.com/questions/684/after-fixing-props-conf-how-to-re-index-the-same-files-using-the-new-settings" rel="nofollow">http://answers.splunk.com/questions/684/after-fixing-props-conf-how-to-re-index-the-same-files-using-the-new-settings</A> and sort-of docs: <A href="http://www.splunk.com/base/Documentation/4.1.4/Admin/CLIadmincommands" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.4/Admin/CLIadmincommands</A></P> <P>Splunk normally remembers files it has already seen and won't reindex them (even if you rename them) but <CODE>oneshot</CODE> bypasses this mechanism.</P> Thu, 09 Sep 2010 05:32:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-undelete-a-input-source/m-p/46569#M8803 gkanapathy 2010-09-09T05:32:21Z