Getting Data In

How do I force a universal forwarder to reindex all its inputs?



Is there a way to make a Universal Forwarder reindex all its inputs?


0 Karma


Hi daniel333,

btool is used to view or validate Splunk config files.
Probably btprobe was meant in the previous answer, which enables you to remove fish bucket information for a specific file.
Easiest way to re-index all inputs on a universal forwarder is to delete the fish bucket index while Splunk UF is stopped:

 $SPLUNK_HOME/bin/splunk stop
 rm -rf $SPLUNK_HOME/var/lib/splunk/fishbucket
 $SPLUNK_HOME/bin/splunk start

Splunk will re-create the fish bucket index and immediately re-index all the inputs on your universal forwarder, so watch out for your license usage 😉

cheers, MuS

Ultra Champion

A sensational explanation at How to reindex data from a forwarder

New Member

404 -- not found

0 Karma

Esteemed Legend