Getting Data In

How do I reindex data with change of crcSalt if crcSalt = is used?

mlorch
Path Finder

I have a data input which uses

crcSalt = <SOURCE>

Task is to reindex these data. Preferably using the crcSalt optione (see How to reindex data from a forwarder)

I already tested

crcSalt = REINDEXME<SOURCE>

but of course it doesn't work.

Any idea - except from "modify the first line of the files to reindex" or "clean the fishbucket"?

0 Karma
1 Solution

mlorch
Path Finder

Hi somesoni2,
I have no access to the source. Anyway: We will mount the source path to another server. This "new" forwarder doesn't know these files by now. Providing it the configuration together with a "ignoreOlderThan" should do the trick.
Thanks!

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi mlorch,
You have to cut from your row REINDEXME.
Bye.
Giuseppe

0 Karma

mlorch
Path Finder

Hi Giuseppe,
misunderstanding: For this stanza I already have

crcSalt = <SOURCE>

To reindex I usually use something like

crcSalt = REINDEXME01

So from technical point of view it should be possible to combine both options, path and string. But this option seems not to be implemented.

0 Karma

mlorch
Path Finder

Hi somesoni2,
I have no access to the source. Anyway: We will mount the source path to another server. This "new" forwarder doesn't know these files by now. Providing it the configuration together with a "ignoreOlderThan" should do the trick.
Thanks!

somesoni2
Revered Legend

That should just work fine. You can convert your comment above as Answer (mouse hover shows 'More' options, 2nd last) and accept it, so that others can benefit for your solution.

0 Karma

somesoni2
Revered Legend

How about just renaming the files to something else? Since the crc Handler includes the file name, updating the file name in any way would cause it to re-index the data.

Other option would be to copy to files to be re-indexed to some different folder and use new monitoring stanza with same index/sourcetype/crcSalt.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...