Clear index on all indexers and re-sending all events from universal forwarders

[DanneFo]

Hello

What is the recommended way to clear an index present on all our indexers and then make all the universal forwarders re-send all the events on respective Windows server?

[robgora_deloitt · Accepted solution]

Once you clean your Indexer, you will also have to reset your fishbucket on your Universal forwarder. Without reseting the fishbucket, you won't be able to have your server resend all the data. Easiest way to do it is to stop the Universal Forwarder and then delete the fishbucket from /Splunkforwarder/var/lib/splunk/fishbucket

You can find all the info you need for deleting the Indexes and all here:
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk

[p_gurav]

Clean indexes in a multisite indexer cluster following these steps:
./splunk offline command on each indexer
./splunk clean eventdata
./splunk start on all indexers

This procedure worked fine for us, the master had to rebalance some stuff but didnt' had any remarkable errors or warnings and fixed all buckets as it should.

Also there is other way given here,
https://answers.splunk.com/answers/387161/official-way-to-clean-indexed-data-from-index-clus.html

[DanneFo]

This worked perfectly. I cannot select two answers as an "accepted answer" though 😐

[p_gurav]

Happy to help!! 🙂