Getting Data In

Can I linebreak indexed data that's not correctly linebroken?

clyde772
Communicator

I have seen manytime where Splunk didn't copped either multi or single line data correctly ending up with events that are 200-300 lines long. In this case, do I have to re-index those data after deleting or can I chop the data that's already indexed in Splunk's index?

Tags (2)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Once the event has been indexed, about all you can do with it is delete it and reload it. When setting up new data sources, I always feed them into a "testdata" index for a few days until I see that I have my line breaks and such set up right. That way, it's easy enough to just delete that whole index instead of having to use the "delete" search operator -- which takes a lot longer.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Once the event has been indexed, about all you can do with it is delete it and reload it. When setting up new data sources, I always feed them into a "testdata" index for a few days until I see that I have my line breaks and such set up right. That way, it's easy enough to just delete that whole index instead of having to use the "delete" search operator -- which takes a lot longer.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...