Events from a log were not breaking properly so I edited props.conf to fix the issue, but is it possible to reindex the old data to ensure proper event breaking?

[ankithreddy777]

I have ingested the data from a log file but the events were not breaking properly. So I edited the props.conf file to fix the issue.

The issue is fixed and current events are breaking properly. But how do I deal with old data which is already ingested with uneven event breaking? I have a limitation that my indexer should not be restarted since it is live.

[aaraneta_splunk]

Hi @ankithreddy777 - I got a notification that you accepted the answer by rjthibod but then I saw this post and it was unaccepted. Did you accidentally unaccept the answer?

[rjthibod]

In my opinion, the easiest approach to reindex the data without touching the forwarder or internals of the indexer are to do as follows. Note this will require 'delete' capability on your user and will count against your data volume license for the day

• write an SPL search to find the data for the time period before you fixed the settings
• from the search export the old data in its raw form to a file on your local machine
• delete the old data by adding | delete to the end of the query used to export the data in the previous step
• go to "Settings" -> "Add Data" -> "Upload" -> select your file -> and then follow the prompts to set the proper sourcetype and index

[thejeffreystone]

I typically leave it since going forward all the data is right. But I guess it depends on how long it was not breaking properly. I have never done it but I believe you could delete the data in your index, delete the fishbucket on your universal forwarder, and just reingest the data. If it is a lot of data then that might be intensive.

[thejeffreystone]

This might help too:
https://answers.splunk.com/answers/134553/how-to-delete-data-index-reset-start-from-scratch.html