Getting Data In

How to delete all indexed data and reindex from all the forwarders in our environment?

Path Finder

We're still building out our Splunk environment (pre-implementation) and have been forwarding data from lots of different data sources. We're still working on correctly defining sourcetypes via inputs.conf.

Once we have inputs.conf fully defined, I plan to delete all indexed data using the ./splunk clean eventdata –index command.

I then want to reindex all the data from all the forwarders. Do I need to do anything to make this happen (once the data has been deleted from the indexes)?

Do I need to add crcSalt = to each stanza in inputs.conf? Do I also need to run the './splunk clean all' command on each forwarder to clear out the _fishbucket?


Tags (3)
0 Karma



You need to clean fishbucket on forwarder.

1.) Stop splunkforwarder
2.) Remove fishbucket or clean fishbucket
3.) Start splunkforwarder


0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!