Getting Data In
Highlighted

Can I linebreak indexed data that's not correctly linebroken?

Communicator

I have seen manytime where Splunk didn't copped either multi or single line data correctly ending up with events that are 200-300 lines long. In this case, do I have to re-index those data after deleting or can I chop the data that's already indexed in Splunk's index?

Tags (2)
0 Karma
Highlighted

Re: Can I linebreak indexed data that's not correctly linebroken?

SplunkTrust
SplunkTrust

Once the event has been indexed, about all you can do with it is delete it and reload it. When setting up new data sources, I always feed them into a "testdata" index for a few days until I see that I have my line breaks and such set up right. That way, it's easy enough to just delete that whole index instead of having to use the "delete" search operator -- which takes a lot longer.

View solution in original post