I indexed some data into splunk by .csv file, but there is some problem with it. So I removed them by "|delete" command. Now I want to re-index them, and hope splunk can update the data if the original file is updated.
Then I added data file successfully, but the items are not indexed to splunk, do you know how to make it?
splunk can not update the file, it just re-index the new file.
for your problem, you have two options
1. create a new index and recharge your .csv file inside
2. you either delete this file using the
splunk clean command and then reload you again your file
let me know if this helps.
delete command will not remove the events, there are only hidden from search. Also, Splunk will not forget about this already indexed file.
If this is a test setup and you're just starting, use the
splunk clean all command which will remove the events and also clean up the so called
_fishbucket this is where splunk keeps track of already indexed files.
hope this helps ...
Splunk isn't indexing the file because it thinks it already has.
crcSalt = <source>
Adding that under the stanza where you've identified the specific input will change the hash sufficiently that splunk will re-index. Once you make that change and restart splunk it should pick it back up again to be indexed.