Getting Data In

Deleting Data Source.

jimjohn
Path Finder

I have created a new data input using files and directories option in splunk web.
I have put 3 excel files.
Later I have found some errors in files and I have deleted the host using host=A |delete command.
Later I try to recreated data source with same excel files.
This time host is not populating and displaying in search.
Any idea why this is happening.

Tags (5)
0 Karma

lguinn2
Legend

It is happening because Splunk knows that it already read these files and will not index them twice. You can reset the file pointers for these files usingbtprobe. Here is a good question/answer that describe this:

btprobe and re-indexing data

Documentation on btprobe

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...