Force Reload of Files

[andrewkenth]

I am interested in reloading some files into Splunk however Splunk is (rightfully) ignoring the files as they havee already been loaded. Is there a way to force Splunk to reload these files?

[gfuente · Accepted solution]

You need to clean the fishbucket (you can find how to do it here at splunk answers) or modify the header of the file, to make splunk think is a new one not indexed yet.

Regards

[andrewkenth]

I was able to do this by using the following commands:

splunk stop
splunk clean eventdata _fishbucket -index
splunk clean eventdata -index

Then I restart Splunk and moved the files I wanted to reload into monitored directories.