topic Re: Reset Splunk Data in Getting Data In

Reset Splunk Data

singhvikas — Wed, 10 Mar 2021 12:39:21 GMT

Hey guys,

Let's say I have an index called test.

I am only ingesting EVTX by modifying the inputs.conf

[monitor://D:\winevt\logs\*] index = test sourcetype = preprocess-winevt crcSalt = <SOURCE>

Now there's an extra huge EVTX which is very slow to index and I want to just start afresh! What approach should I take?

I would like to -

splunk stop splunk clean eventdata splunk start

but would it:

1. Rest my inputs.conf? I guess no

2. If not, wouldn't it again start indexing from where I left off(given I have not changed the input and not touched the physical files)? This is what I'm seeing in my environment.

Thanks,

Vikas

Re: Reset Splunk Data

gcusello — Wed, 10 Mar 2021 12:53:32 GMT

Hi @singhvikas,

if you're speaking of a development index, you could also use the delete command that's faster than the other way but it doesn't delete events from the index, it only marks them as deleted.

Anyway the approach you described is the correct one but BEWARE: if you don't insert the clause "-index <index_name>" in the command you clean all the indexes not only the test one!!!

Ciao.

Giuseppe

Re: Reset Splunk Data

singhvikas — Wed, 10 Mar 2021 12:56:03 GMT

Hi @gcusello

Thank you for your response, I appreciate the help (and the word of caution!)

Umm.. just to be clear, if the data is STILL being indexed. I can

splunk stop splunk clean eventdata splunk start

what happens when splunk starts? It will start the indexing from scratch as per my configuration here?

[monitor://D:\winevt\logs\*] index = test sourcetype = preprocess-winevt crcSalt = <SOURCE>

Re: Reset Splunk Data

gcusello — Wed, 10 Mar 2021 13:37:36 GMT

Hi @singhvikas,

Splunk doesn't index twice a log, so the already indexed data will not be indexed again by default.

If you need to reindex them, you have to change the name of filename and use (as you are doing) crcSalt = <SOURCE> option in your input stanza.

Ciao.

Giuseppe