Getting Data In

How to reindex data which is coming from syslog server to splunk ?

splunker969
Communicator

Please hlep me how I can reindex data which is coming from syslog server to splunk?

Thanks ,
splunker969

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What's your use-case here? Do you want to re-index (need more information on what you mean here) OR re-parse?

0 Karma

splunker969
Communicator

customer is sending data to our syslog server where the server is acting as uf also .Since he came back and asking on last tuesday the data was missing from hosts and I am looking how can i reindex data from last tuesday .Now at present data is coimng correctly .

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So is your syslog saving the files somewhere (probably where UF is monitoring it)?

0 Karma

splunker969
Communicator

I found that we dont have those files in our syslog server .Can you help me how to re index missing data ?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Well, you'd have to ask them to send the data again (if you're not saving them and haven't ingested in Splunk, they are lost). You can ask them to send it to same syslog port, so that it's processed the same way.

0 Karma

splunker969
Communicator

Thanks somesoni2

0 Karma

splunker969
Communicator

can you hlep me in two cases if it was saving and not saving flies ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...