Getting Data In

How do I force a universal forwarder to reindex all its inputs?

daniel333
Builder

All,

Is there a way to make a Universal Forwarder reindex all its inputs?

thanks
-Daniel

0 Karma

MuS
Legend

Hi daniel333,

btool is used to view or validate Splunk config files.
Probably btprobe was meant in the previous answer, which enables you to remove fish bucket information for a specific file.
Easiest way to re-index all inputs on a universal forwarder is to delete the fish bucket index while Splunk UF is stopped:

 $SPLUNK_HOME/bin/splunk stop
 rm -rf $SPLUNK_HOME/var/lib/splunk/fishbucket
 $SPLUNK_HOME/bin/splunk start

Splunk will re-create the fish bucket index and immediately re-index all the inputs on your universal forwarder, so watch out for your license usage 😉

cheers, MuS

ddrillic
Ultra Champion

A sensational explanation at How to reindex data from a forwarder

vpassaro
New Member

404 -- not found

0 Karma

woodcock
Esteemed Legend

spl_unker
Explorer

is there a way to clear fishbucket  without reindexing? In one of the old UF , fishbucket file has occupied complete disk space and i need to clear the file to run Splunk again.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...