Getting Data In
Highlighted

Clear index on all indexers and re-sending all events from universal forwarders

Explorer

Hello

What is the recommended way to clear an index present on all our indexers and then make all the universal forwarders re-send all the events on respective Windows server?

0 Karma
Highlighted

Re: Clear index on all indexers and re-sending all events from universal forwarders

Champion

Clean indexes in a multisite indexer cluster following these steps:
./splunk offline command on each indexer
./splunk clean eventdata
./splunk start on all indexers

This procedure worked fine for us, the master had to rebalance some stuff but didnt' had any remarkable errors or warnings and fixed all buckets as it should.

Also there is other way given here,
https://answers.splunk.com/answers/387161/official-way-to-clean-indexed-data-from-index-clus.html

Highlighted

Re: Clear index on all indexers and re-sending all events from universal forwarders

Explorer

This worked perfectly. I cannot select two answers as an "accepted answer" though 😐

0 Karma
Highlighted

Re: Clear index on all indexers and re-sending all events from universal forwarders

Champion

Happy to help!! 🙂

0 Karma
Highlighted

Re: Clear index on all indexers and re-sending all events from universal forwarders

Path Finder

Once you clean your Indexer, you will also have to reset your fishbucket on your Universal forwarder. Without reseting the fishbucket, you won't be able to have your server resend all the data. Easiest way to do it is to stop the Universal Forwarder and then delete the fishbucket from /Splunkforwarder/var/lib/splunk/fishbucket

You can find all the info you need for deleting the Indexes and all here:
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk

View solution in original post