Getting Data In

How to reset Splunk UF to re-monitor a single directory, not all directories?

Glasses
Builder

Hi -

I have a Splunk UF monitoring many directories on a rsyslog (receiver) server.

One of the directories populated with logs as expected.

However, the input stanza had the incorrect sourcetype and the data/logs did not index.

Now after removing the sourcetype, I need to reset the UF to re-monitor the log files in that single directory "only".   I do NOT want to re-index everything the UF monitors.

Please advise the best way to handle this...

Thank you

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Hi
You can reset individual file in fishbucket to reread it by btprobe command. https://docs.splunk.com/Documentation/Splunk/8.2.3/Troubleshooting/CommandlinetoolsforusewithSupport
R. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
You can reset individual file in fishbucket to reread it by btprobe command. https://docs.splunk.com/Documentation/Splunk/8.2.3/Troubleshooting/CommandlinetoolsforusewithSupport
R. Ismo
0 Karma