Getting Data In

Deleted Data now want forwarder to resend log file

kpuscas
New Member

Worked through the tutorial on splunkstorm and when done wanted to delete the data via the storage web UI and accidentally deleted a log file that a forwarder was monitoring. File still shows as being monitored on the server but not see the data. Is there some kind of reset or re-index that needs to be done?

thanks

Tags (2)
0 Karma

MarioM
Motivator

Normally if you remove the content in splunkforwarder/var/lib/splunk/fishbucket it should restart monitoring as new and resend everything

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...