Getting Data In

How to delete all indexed data and reindex from all the forwarders in our environment?

Path Finder

We're still building out our Splunk environment (pre-implementation) and have been forwarding data from lots of different data sources. We're still working on correctly defining sourcetypes via inputs.conf.

Once we have inputs.conf fully defined, I plan to delete all indexed data using the ./splunk clean eventdata –index command.

I then want to reindex all the data from all the forwarders. Do I need to do anything to make this happen (once the data has been deleted from the indexes)?

Do I need to add crcSalt = to each stanza in inputs.conf? Do I also need to run the './splunk clean all' command on each forwarder to clear out the _fishbucket?

Thanks.

Tags (3)
0 Karma

SplunkTrust
SplunkTrust

Hi,

You need to clean fishbucket on forwarder.

1.) Stop splunkforwarder
2.) Remove fishbucket or clean fishbucket
3.) Start splunkforwarder

Thanks,
Harshil

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!