topic Re: upload deleted iis log file in Getting Data In

upload deleted iis log file

nkarthiece — Thu, 10 Jul 2014 06:30:37 GMT

Hi,

Yesterday i deleted one indexed iis logfile.

But now i want to analyze the indexed iis log file.
Please help me on this.

Re: upload deleted iis log file

nkarthiece — Thu, 10 Jul 2014 07:25:27 GMT

i want to analyze the same log file what i have deleted

Re: upload deleted iis log file

martin_mueller — Thu, 10 Jul 2014 17:46:26 GMT

Have you deleted the file from the source machine or the events from the index or both?

Re: upload deleted iis log file

nkarthiece — Fri, 11 Jul 2014 06:42:21 GMT

delete events from index...... using command
source="D:\desktop\iislog server 8\14.8\W3SVC2\u_ex140711.log" aspx | delete

Again i want to index the same file.its is not working
please help me on this.

Re: upload deleted iis log file

martin_mueller — Fri, 11 Jul 2014 07:28:51 GMT

Splunk remembers that it has already indexed that file in the fishbucket. You could either modify the file header, or provide a crcsalt in your inputs.conf. Emptying the fishbucket will affect other inputs on that machine.