How to re-index the deleted data in splunk.

[felix_fxm]

I indexed some data into splunk by .csv file, but there is some problem with it. So I removed them by "|delete" command. Now I want to re-index them, and hope splunk can update the data if the original file is updated.
Then I added data file successfully, but the items are not indexed to splunk, do you know how to make it?

[gyslainlatsa]

splunk can not update the file, it just re-index the new file.
for your problem, you have two options
1. create a new index and recharge your .csv file inside
2. you either delete this file using the splunk clean command and then reload you again your file
let me know if this helps.

[MuS]

Hi felix_fxm,

using the delete command will not remove the events, there are only hidden from search. Also, Splunk will not forget about this already indexed file.

If this is a test setup and you're just starting, use the splunk clean all command which will remove the events and also clean up the so called _fishbucket this is where splunk keeps track of already indexed files.

hope this helps ...

cheers, MuS

[rgonzale6]

Splunk isn't indexing the file because it thinks it already has.

You need to edit inputs.conf with a CRC salt so the hash splunk makes upon indexing files is changed...

crcSalt = <source>

Adding that under the stanza where you've identified the specific input will change the hash sufficiently that splunk will re-index. Once you make that change and restart splunk it should pick it back up again to be indexed.

[mzq]

there are multiple files with the same name, on my win machine I modified C:\Program Files\Splunk\etc\system\local\inputs.conf