Getting Data In

How to re-index the deleted data in splunk.

felix_fxm
Engager

I indexed some data into splunk by .csv file, but there is some problem with it. So I removed them by "|delete" command. Now I want to re-index them, and hope splunk can update the data if the original file is updated.
Then I added data file successfully, but the items are not indexed to splunk, do you know how to make it?

Tags (2)

gyslainlatsa
Motivator

splunk can not update the file, it just re-index the new file.
for your problem, you have two options
1. create a new index and recharge your .csv file inside
2. you either delete this file using the splunk clean command and then reload you again your file
let me know if this helps.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi felix_fxm,

using the delete command will not remove the events, there are only hidden from search. Also, Splunk will not forget about this already indexed file.

If this is a test setup and you're just starting, use the splunk clean all command which will remove the events and also clean up the so called _fishbucket this is where splunk keeps track of already indexed files.

hope this helps ...

cheers, MuS

rgonzale6
Path Finder

Splunk isn't indexing the file because it thinks it already has.

You need to edit inputs.conf with a CRC salt so the hash splunk makes upon indexing files is changed...

crcSalt = <source>

Adding that under the stanza where you've identified the specific input will change the hash sufficiently that splunk will re-index. Once you make that change and restart splunk it should pick it back up again to be indexed.

mzq
Engager

there are multiple files with the same name, on my win machine I modified C:\Program Files\Splunk\etc\system\local\inputs.conf

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...