How to re-index without clearing event data


What is the easiest way to make changes for data parsing and then re-load all of the data that has already been indexed. We do not want to clear / delete any of the events that have already been captured but we would just like to re-index all of the data that has already ran through the indexing process.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

You can either use the splunk add oneshot command, or if you are using the Splunk file monitor, you can perform a clean of the fishbucket index on the input instance.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!