Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to reindex data which is coming from syslo...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to reindex data which is coming from syslog server to splunk ?
splunker969
Communicator
04-23-2018
08:30 AM
Please hlep me how I can reindex data which is coming from syslog server to splunk?
Thanks ,
splunker969
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
somesoni2
Revered Legend
04-23-2018
08:47 AM
What's your use-case here? Do you want to re-index (need more information on what you mean here) OR re-parse?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunker969
Communicator
04-23-2018
08:53 AM
customer is sending data to our syslog server where the server is acting as uf also .Since he came back and asking on last tuesday the data was missing from hosts and I am looking how can i reindex data from last tuesday .Now at present data is coimng correctly .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
somesoni2
Revered Legend
04-23-2018
09:05 AM
So is your syslog saving the files somewhere (probably where UF is monitoring it)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunker969
Communicator
04-23-2018
09:50 AM
I found that we dont have those files in our syslog server .Can you help me how to re index missing data ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
somesoni2
Revered Legend
04-23-2018
11:10 AM
Well, you'd have to ask them to send the data again (if you're not saving them and haven't ingested in Splunk, they are lost). You can ask them to send it to same syslog port, so that it's processed the same way.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunker969
Communicator
04-23-2018
11:48 AM
Thanks somesoni2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunker969
Communicator
04-23-2018
09:12 AM
can you hlep me in two cases if it was saving and not saving flies ?
Get Updates on the Splunk Community!
Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...
This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...
Elevate Your Organization with Splunk’s Next Platform Evolution
Thursday, July 10, 2025 | 11AM PDT / 2PM EDT
Whether you're managing complex deployments or looking to ...
Splunk Answers Content Calendar, June Edition
Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...
