https://community.splunk.com/t5/Splunk-Search/How-to-re-index-without-clearing-event-data/m-p/77933#M181591 <P>What is the easiest way to make changes for data parsing and then re-load all of the data that has already been indexed. We do not want to clear / delete any of the events that have already been captured but we would just like to re-index all of the data that has already ran through the indexing process. </P> Mon, 19 Sep 2011 16:54:48 GMT travistrp 2011-09-19T16:54:48Z https://community.splunk.com/t5/Splunk-Search/How-to-re-index-without-clearing-event-data/m-p/77933#M181591 <P>What is the easiest way to make changes for data parsing and then re-load all of the data that has already been indexed. We do not want to clear / delete any of the events that have already been captured but we would just like to re-index all of the data that has already ran through the indexing process. </P> Mon, 19 Sep 2011 16:54:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-re-index-without-clearing-event-data/m-p/77933#M181591 travistrp 2011-09-19T16:54:48Z https://community.splunk.com/t5/Splunk-Search/How-to-re-index-without-clearing-event-data/m-p/77934#M181592 <P>You can either use the <CODE>splunk add oneshot</CODE> command, or if you are using the Splunk file monitor, you can perform a <CODE>clean</CODE> of the fishbucket index on the input instance.</P> Mon, 19 Sep 2011 18:00:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-re-index-without-clearing-event-data/m-p/77934#M181592 gkanapathy 2011-09-19T18:00:37Z