How to reset Splunk UF to re-monitor a single directory, not all directories?

[Glasses]

Hi -

I have a Splunk UF monitoring many directories on a rsyslog (receiver) server.

One of the directories populated with logs as expected.

However, the input stanza had the incorrect sourcetype and the data/logs did not index.

Now after removing the sourcetype, I need to reset the UF to re-monitor the log files in that single directory "only".   I do NOT want to re-index everything the UF monitors.

Please advise the best way to handle this...

Thank you

[isoutamo · Accepted solution]

Hi
You can reset individual file in fishbucket to reread it by btprobe command. https://docs.splunk.com/Documentation/Splunk/8.2.3/Troubleshooting/CommandlinetoolsforusewithSupport
R. Ismo