Getting Data In

Deleting Data Source.

jimjohn
Path Finder

I have created a new data input using files and directories option in splunk web.
I have put 3 excel files.
Later I have found some errors in files and I have deleted the host using host=A |delete command.
Later I try to recreated data source with same excel files.
This time host is not populating and displaying in search.
Any idea why this is happening.

Tags (5)
0 Karma

lguinn2
Legend

It is happening because Splunk knows that it already read these files and will not index them twice. You can reset the file pointers for these files usingbtprobe. Here is a good question/answer that describe this:

btprobe and re-indexing data

Documentation on btprobe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...