How to reindex data which is coming from syslog server to splunk ?

[splunker969]

Please hlep me how I can reindex data which is coming from syslog server to splunk?

Thanks ,
splunker969

[somesoni2]

What's your use-case here? Do you want to re-index (need more information on what you mean here) OR re-parse?

[splunker969]

customer is sending data to our syslog server where the server is acting as uf also .Since he came back and asking on last tuesday the data was missing from hosts and I am looking how can i reindex data from last tuesday .Now at present data is coimng correctly .

[somesoni2]

So is your syslog saving the files somewhere (probably where UF is monitoring it)?

[splunker969]

I found that we dont have those files in our syslog server .Can you help me how to re index missing data ?

[somesoni2]

Well, you'd have to ask them to send the data again (if you're not saving them and haven't ingested in Splunk, they are lost). You can ask them to send it to same syslog port, so that it's processed the same way.

[splunker969]

Thanks somesoni2

[splunker969]

can you hlep me in two cases if it was saving and not saving flies ?