Archive
Highlighted

How to force the re-indexing of selective data on a forwarder?

Contributor

I have done "splunk clean eventdata -index XXX" on indexers
and cleaned "fishbucket" on forwarders
problem occurs when i start splunkd:
indexs which are not cleaned begin to load date the second time, events duplicated
How could i clean a certain index an reload it individually?
Thank you!

Tags (1)
Highlighted

Re: How to force the re-indexing of selective data on a forwarder?

Splunk Employee
Splunk Employee

I would suggest that you try the steps described in this Splunk Answer on your forwarder against the specific files you want to re-index.

View solution in original post

Highlighted

Re: How to force the re-indexing of selective data on a forwarder?

Contributor

OK Thank you very much!
I saw your amendment
I am staring at that for a long while and doubting does it seem a little different form what i saw one second ago

0 Karma
Highlighted

Re: How to force the re-indexing of selective data on a forwarder?

Splunk Employee
Splunk Employee

You have to invoke btprobe with the following command line syntax:

$SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/bin/btprobe

I amended the Splunk Answer referenced to reflect this.

0 Karma