I have done "splunk clean eventdata -index XXX" on indexers
and cleaned "fishbucket" on forwarders
problem occurs when i start splunkd:
indexs which are not cleaned begin to load date the second time, events duplicated
How could i clean a certain index an reload it individually?
OK Thank you very much!
I saw your amendment
I am staring at that for a long while and doubting does it seem a little different form what i saw one second ago
You have to invoke btprobe with the following command line syntax:
$SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/bin/btprobe
I amended the Splunk Answer referenced to reflect this.