I have seen manytime where Splunk didn't copped either multi or single line data correctly ending up with events that are 200-300 lines long. In this case, do I have to re-index those data after deleting or can I chop the data that's already indexed in Splunk's index?
Once the event has been indexed, about all you can do with it is delete it and reload it. When setting up new data sources, I always feed them into a "testdata" index for a few days until I see that I have my line breaks and such set up right. That way, it's easy enough to just delete that whole index instead of having to use the "delete" search operator -- which takes a lot longer.
Once the event has been indexed, about all you can do with it is delete it and reload it. When setting up new data sources, I always feed them into a "testdata" index for a few days until I see that I have my line breaks and such set up right. That way, it's easy enough to just delete that whole index instead of having to use the "delete" search operator -- which takes a lot longer.