Getting Data In

How do I force a universal forwarder to reindex all its inputs?

Builder

All,

Is there a way to make a Universal Forwarder reindex all its inputs?

thanks
-Daniel

0 Karma

SplunkTrust
SplunkTrust

Hi daniel333,

btool is used to view or validate Splunk config files.
Probably btprobe was meant in the previous answer, which enables you to remove fish bucket information for a specific file.
Easiest way to re-index all inputs on a universal forwarder is to delete the fish bucket index while Splunk UF is stopped:

 $SPLUNK_HOME/bin/splunk stop
 rm -rf $SPLUNK_HOME/var/lib/splunk/fishbucket
 $SPLUNK_HOME/bin/splunk start

Splunk will re-create the fish bucket index and immediately re-index all the inputs on your universal forwarder, so watch out for your license usage 😉

cheers, MuS

Ultra Champion

A sensational explanation at How to reindex data from a forwarder

New Member

404 -- not found

0 Karma

Esteemed Legend