How do I force a universal forwarder to reindex all its inputs?

[daniel333]

All,

Is there a way to make a Universal Forwarder reindex all its inputs?

thanks
-Daniel

[MuS]

Hi daniel333,

btool is used to view or validate Splunk config files.
Probably btprobe was meant in the previous answer, which enables you to remove fish bucket information for a specific file.
Easiest way to re-index all inputs on a universal forwarder is to delete the fish bucket index while Splunk UF is stopped:

 $SPLUNK_HOME/bin/splunk stop
 rm -rf $SPLUNK_HOME/var/lib/splunk/fishbucket
 $SPLUNK_HOME/bin/splunk start

Splunk will re-create the fish bucket index and immediately re-index all the inputs on your universal forwarder, so watch out for your license usage 😉

cheers, MuS

[ddrillic]

A sensational explanation at How to reindex data from a forwarder

[vpassaro]

404 -- not found

[woodcock]

Reset the fishbucket with btprobe:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Troubleshooting/CommandlinetoolsforusewithSupport

[spl_unker]

is there a way to clear fishbucket  without reindexing? In one of the old UF , fishbucket file has occupied complete disk space and i need to clear the file to run Splunk again.