Can I linebreak indexed data that's not correctly linebroken?

[clyde772]

I have seen manytime where Splunk didn't copped either multi or single line data correctly ending up with events that are 200-300 lines long. In this case, do I have to re-index those data after deleting or can I chop the data that's already indexed in Splunk's index?

[dwaddle · Accepted solution]

Once the event has been indexed, about all you can do with it is delete it and reload it. When setting up new data sources, I always feed them into a "testdata" index for a few days until I see that I have my line breaks and such set up right. That way, it's easy enough to just delete that whole index instead of having to use the "delete" search operator -- which takes a lot longer.