How do I reindex data with change of crcSalt if crcSalt = is used?

[mlorch]

I have a data input which uses

crcSalt = <SOURCE>

Task is to reindex these data. Preferably using the crcSalt optione (see How to reindex data from a forwarder)

I already tested

crcSalt = REINDEXME<SOURCE>

but of course it doesn't work.

Any idea - except from "modify the first line of the files to reindex" or "clean the fishbucket"?

[gcusello]

Hi mlorch,
You have to cut from your row REINDEXME.
Bye.
Giuseppe

[mlorch]

Hi Giuseppe,
misunderstanding: For this stanza I already have

crcSalt = <SOURCE>

To reindex I usually use something like

crcSalt = REINDEXME01

So from technical point of view it should be possible to combine both options, path and string. But this option seems not to be implemented.

[mlorch · Accepted solution]

Hi somesoni2,
I have no access to the source. Anyway: We will mount the source path to another server. This "new" forwarder doesn't know these files by now. Providing it the configuration together with a "ignoreOlderThan" should do the trick.
Thanks!

[somesoni2]

That should just work fine. You can convert your comment above as Answer (mouse hover shows 'More' options, 2nd last) and accept it, so that others can benefit for your solution.

[somesoni2]

How about just renaming the files to something else? Since the crc Handler includes the file name, updating the file name in any way would cause it to re-index the data.

Other option would be to copy to files to be re-indexed to some different folder and use new monitoring stanza with same index/sourcetype/crcSalt.