I ran |delete on data. Why won't the forwarder resend?

[matstap]

I ran |delete on some data (oops!). How do I get the universal forwarder to send the data to the indexers again?

[matstap · Accepted solution]

I stopped the forwarder, installed another universal forwarder and configured inputs.conf to monitor only the files I ran |delete on and that worked. I then uninstalled the new forwarder and restarted the old one.
I didn't want to clear the fishbucket because I didn't want ALL of the data to be re-ingested and for some reason the forwarder to forget the specific files wasn't working for me.
Maybe not the best solution, but it worked.

[chrisyounger]

Look at the answer on this page: https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html (look at the second section). It is an excellent write-up of what you need to know.

This is probably what you need:

• on a forwarder by removing the folder $SPLUNK_HOME/var/lib/splunk/fishbucket

or selectively forgot a single file from the fishbucket

• splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset

good luck

[skoelpin]

You need to clear the fishbucket out on the forwarder so it see's it as data it hasn't indexed yet. Option B would be to open the files and insert a single character near the top so it tricks the forwarder into thinking its a new file

https://www.splunk.com/blog/2008/08/14/what-is-this-fishbucket-thing.html