Is it possible to retroactively split logs by deleting the universal forwarder off the server, then reinstall it with props.conf changes?

[skoelpin]

I have about 10 million events in one index and my manager wants me to split them up differently than they currently are. So I went into the props.conf and wrote some regex to correctly split the logs. Now I want to have those logs split retroactively from the first event.

My question.. Would this be possible if I were to delete the forwarder off the server then re-install the forwarder with the changes in my props.conf?

[woodcock · Accepted solution]

Yes, the easiest way is to uninstall and then reinstall Splunk on the forwarder and that will do it. You also need to delete the data that is currently in your indexers like this:

index=myIndex | delete

Yes, I know that doesn't really delete it but for his purposes, it is fine.
If you would like something a bit quicker and less radical, you can search the subject "cleaning the fishbucket" and do that on your forwarder to cause it to forget that it has ever forwarded anything.

[skoelpin]

Excellent explanation!

[matthieu_araman]

hello,

I would use another index for testing (or make a backup)
it's not clear where the data came from
if it's from files on the uf which are still there, then no need to reinstall
you can stop splunk uf, remove the fishbucket directory and restart the uf and splunk will start from scratch
see http://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html

[skoelpin]

Thanks for the info. That link was very helpful!