Getting Data In

Clear index on all indexers and re-sending all events from universal forwarders

DanneFo
Explorer

Hello

What is the recommended way to clear an index present on all our indexers and then make all the universal forwarders re-send all the events on respective Windows server?

0 Karma
1 Solution

robgora_deloitt
Path Finder

Once you clean your Indexer, you will also have to reset your fishbucket on your Universal forwarder. Without reseting the fishbucket, you won't be able to have your server resend all the data. Easiest way to do it is to stop the Universal Forwarder and then delete the fishbucket from /Splunkforwarder/var/lib/splunk/fishbucket

You can find all the info you need for deleting the Indexes and all here:
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk

View solution in original post

robgora_deloitt
Path Finder

Once you clean your Indexer, you will also have to reset your fishbucket on your Universal forwarder. Without reseting the fishbucket, you won't be able to have your server resend all the data. Easiest way to do it is to stop the Universal Forwarder and then delete the fishbucket from /Splunkforwarder/var/lib/splunk/fishbucket

You can find all the info you need for deleting the Indexes and all here:
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk

p_gurav
Champion

Clean indexes in a multisite indexer cluster following these steps:
./splunk offline command on each indexer
./splunk clean eventdata
./splunk start on all indexers

This procedure worked fine for us, the master had to rebalance some stuff but didnt' had any remarkable errors or warnings and fixed all buckets as it should.

Also there is other way given here,
https://answers.splunk.com/answers/387161/official-way-to-clean-indexed-data-from-index-clus.html

DanneFo
Explorer

This worked perfectly. I cannot select two answers as an "accepted answer" though 😐

0 Karma

p_gurav
Champion

Happy to help!! 🙂

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...