How to delete all indexed data and reindex from all the forwarders in our environment?

[ericlarsen]

We're still building out our Splunk environment (pre-implementation) and have been forwarding data from lots of different data sources. We're still working on correctly defining sourcetypes via inputs.conf.

Once we have inputs.conf fully defined, I plan to delete all indexed data using the ./splunk clean eventdata –index command.

I then want to reindex all the data from all the forwarders. Do I need to do anything to make this happen (once the data has been deleted from the indexes)?

Do I need to add crcSalt = to each stanza in inputs.conf? Do I also need to run the './splunk clean all' command on each forwarder to clear out the _fishbucket?

Thanks.

[harsmarvania57]

Hi,

You need to clean fishbucket on forwarder.

1.) Stop splunkforwarder
2.) Remove fishbucket or clean fishbucket
3.) Start splunkforwarder

Thanks,
Harshil