How to undelete a input source

[splukUP]

I have a log file that was |delete'd from the index using search. I want the file back in the index. I did several steps of adding and removing the file as a Splunk input and restarting the machine's splunk. It just won't come back. Is there an easy way to |undelete?

[gkanapathy · Accepted solution]

There is no way to undelete the data. If you still have the original data, you can reindex the file with the Splunk oneshot command, examples http://answers.splunk.com/questions/684/after-fixing-props-conf-how-to-re-index-the-same-files-using... and sort-of docs: http://www.splunk.com/base/Documentation/4.1.4/Admin/CLIadmincommands

Splunk normally remembers files it has already seen and won't reindex them (even if you rename them) but oneshot bypasses this mechanism.