After removing data using the delete command in a search, how do I reindex that data?

[sunnyparmar]

Hi,

I have one delimited tab log file with a .txt extension. I pushed the data from from that log file to the Splunk server, but for some R&D purposes, I have deleted some particular supplier rows from that file with the search:

index=sand_box sourcetype="sc-kofax-extracts" <supplier name> | delete 

Now, I want that particular supplier data again in Splunk and for that, I have restarted my splunk forwarder services many times so that it can push data to the Splunk server, though it is not able to do so. Still i am not able to get data for that particular supplier on the Splunk server so please anybody guide me how to retrieve the data for that particular supplier again.

Thanks
Ankit

[woodcock · Accepted solution]

You need to clear the fishbucket or use oneshot to force it in; read full details here:

http://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html

[sunnyparmar]

Hi,

thanks for replying.. how feasible it is if i am clearing the fishbucket index.. Is it remove all index structure related to my old data?

Thanks & Regards
Ankit

[woodcock]

If you mean get your disk space back, forget about it. If you mean use new configuration files, just deploy the updates before you clear it. If you mean something else, you need to be much more clear. Don't forget to "Accept" to close the question.