Getting Data In
Highlighted

How do I reindex data with change of crcSalt if crcSalt = is used?

Path Finder

I have a data input which uses

crcSalt = <SOURCE>

Task is to reindex these data. Preferably using the crcSalt optione (see How to reindex data from a forwarder)

I already tested

crcSalt = REINDEXME<SOURCE>

but of course it doesn't work.

Any idea - except from "modify the first line of the files to reindex" or "clean the fishbucket"?

0 Karma
Highlighted

Re: How do I reindex data with change of crcSalt if crcSalt = is used?

SplunkTrust
SplunkTrust

How about just renaming the files to something else? Since the crc Handler includes the file name, updating the file name in any way would cause it to re-index the data.

Other option would be to copy to files to be re-indexed to some different folder and use new monitoring stanza with same index/sourcetype/crcSalt.

0 Karma
Highlighted

Re: How do I reindex data with change of crcSalt if crcSalt = is used?

Path Finder

Hi somesoni2,
I have no access to the source. Anyway: We will mount the source path to another server. This "new" forwarder doesn't know these files by now. Providing it the configuration together with a "ignoreOlderThan" should do the trick.
Thanks!

View solution in original post

Highlighted

Re: How do I reindex data with change of crcSalt if crcSalt = is used?

SplunkTrust
SplunkTrust

That should just work fine. You can convert your comment above as Answer (mouse hover shows 'More' options, 2nd last) and accept it, so that others can benefit for your solution.

0 Karma
Highlighted

Re: How do I reindex data with change of crcSalt if crcSalt = is used?

Legend

Hi mlorch,
You have to cut from your row REINDEXME.
Bye.
Giuseppe

0 Karma
Highlighted

Re: How do I reindex data with change of crcSalt if crcSalt = is used?

Path Finder

Hi Giuseppe,
misunderstanding: For this stanza I already have

crcSalt = <SOURCE>

To reindex I usually use something like

crcSalt = REINDEXME01

So from technical point of view it should be possible to combine both options, path and string. But this option seems not to be implemented.

0 Karma