Getting Data In

How to reindex data which is coming from syslog server to splunk ?

splunker969
Communicator

Please hlep me how I can reindex data which is coming from syslog server to splunk?

Thanks ,
splunker969

0 Karma

somesoni2
Revered Legend

What's your use-case here? Do you want to re-index (need more information on what you mean here) OR re-parse?

0 Karma

splunker969
Communicator

customer is sending data to our syslog server where the server is acting as uf also .Since he came back and asking on last tuesday the data was missing from hosts and I am looking how can i reindex data from last tuesday .Now at present data is coimng correctly .

0 Karma

somesoni2
Revered Legend

So is your syslog saving the files somewhere (probably where UF is monitoring it)?

0 Karma

splunker969
Communicator

I found that we dont have those files in our syslog server .Can you help me how to re index missing data ?

0 Karma

somesoni2
Revered Legend

Well, you'd have to ask them to send the data again (if you're not saving them and haven't ingested in Splunk, they are lost). You can ask them to send it to same syslog port, so that it's processed the same way.

0 Karma

splunker969
Communicator

Thanks somesoni2

0 Karma

splunker969
Communicator

can you hlep me in two cases if it was saving and not saving flies ?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...