Clean Forwarder fishbuckets for one sourcetype

[robertlynch2020]

Hi - I have a command to clean fish buckets in a forwarder - if i want to take back in data for testing etc...

cd var/lib/splunk/
rm -r fishbucket/
bin/splunk stop; cd var/lib/splunk/ ; rm -r fishbucket/ ;cd - ; rm -r var/ ; bin/splunk start

But is there any way to clean fish buckets for only one source type?

[isoutamo]

Hi

https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-data-from-a-forwarder/td-p/93310 and item "or selectivelly forgot a single file from the fishbucket" like

splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset

Before that you must stop Splunk on that node.

r. Ismo