topic Re: Reindex a file on 3000 machines in Splunk Search

Reindex a file on 3000 machines

daniel333 — Fri, 11 Jan 2019 23:21:47 GMT

All,

I indexed a 30-line config file off all our Linux hosts. But accidentally used the wrong source-type and index. So I deleted the delete with | delete. Now I need to reindex the file now that I have the correct inputs.conf configured. I thought it would as simple as adding

crcsalt= and I'd be set. But it's not working. Any ideas?

Re: Reindex a file on 3000 machines

martin_mueller — Sat, 12 Jan 2019 00:32:55 GMT

You can change the init CRC length in your inputs.conf, that will invalidate all fishbucket entries you previously had.

Re: Reindex a file on 3000 machines

daniel333 — Sat, 12 Jan 2019 01:21:09 GMT

Tried this with no luck. I suspect since this file is very tiny that the CRC init might not play a factor but I am honestly not sure. Any other tricks?

Re: Reindex a file on 3000 machines

martin_mueller — Sat, 12 Jan 2019 15:43:59 GMT

A 30-line config file should be long enough for a 256b CRC - that's just eight byte per line.

Note, configuration keys are case sensitive. Make sure you used crcSalt and initCrcLength as specified in inputs.conf.

Re: Reindex a file on 3000 machines

gjanders — Sun, 13 Jan 2019 02:30:36 GMT

if you just want to ingest this file once off than perhaps oneshot? As per https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI