Getting Data In

How to re-index the deleted data in splunk.

felix_fxm
Engager

I indexed some data into splunk by .csv file, but there is some problem with it. So I removed them by "|delete" command. Now I want to re-index them, and hope splunk can update the data if the original file is updated.
Then I added data file successfully, but the items are not indexed to splunk, do you know how to make it?

Tags (2)

gyslainlatsa
Motivator

splunk can not update the file, it just re-index the new file.
for your problem, you have two options
1. create a new index and recharge your .csv file inside
2. you either delete this file using the splunk clean command and then reload you again your file
let me know if this helps.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi felix_fxm,

using the delete command will not remove the events, there are only hidden from search. Also, Splunk will not forget about this already indexed file.

If this is a test setup and you're just starting, use the splunk clean all command which will remove the events and also clean up the so called _fishbucket this is where splunk keeps track of already indexed files.

hope this helps ...

cheers, MuS

rgonzale6
Path Finder

Splunk isn't indexing the file because it thinks it already has.

You need to edit inputs.conf with a CRC salt so the hash splunk makes upon indexing files is changed...

crcSalt = <source>

Adding that under the stanza where you've identified the specific input will change the hash sufficiently that splunk will re-index. Once you make that change and restart splunk it should pick it back up again to be indexed.

mzq
Engager

there are multiple files with the same name, on my win machine I modified C:\Program Files\Splunk\etc\system\local\inputs.conf

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...