We're still building out our Splunk environment (pre-implementation) and have been forwarding data from lots of different data sources. We're still working on correctly defining sourcetypes via inputs.conf.
Once we have inputs.conf fully defined, I plan to delete all indexed data using the ./splunk clean eventdata –index command.
I then want to reindex all the data from all the forwarders. Do I need to do anything to make this happen (once the data has been deleted from the indexes)?
Do I need to add crcSalt = to each stanza in inputs.conf? Do I also need to run the './splunk clean all' command on each forwarder to clear out the _fishbucket?