Logs have been FIFO'd but i still need. How do i get them back in?

[Jarohnimo]

Working in Windows I have a directory of sharepoint logs that i have been pulling for years. I've recently started to pull in the upgrade logs but they are years old and what happened is they were pulled in but because the data in the log were a few years old it was immediately fifo'd out (I should of placed those logs in a seperate index,... my mistake).

I'd like to setup a new deployment app that only pulls the logs like: Upgrade-2018-094336-984.log and Upgrade-2018-094336-984-error.log. (I'm guesting some form of regex/ whitelist (can someone help me with the syntax)...

what's the easiest way to do this? does it involve clearing the fishbucket? I'm hoping i can create a new index and deploy the app and it just works? thoughts?

[hortonew]

Yes, if you need to re-ingest data on the same host that already ingested them, the fishbucket is keeping track that it already ingested them and won't again. Push your new app that sends those logs to the new location, remove fishbucket entries for that, restart splunk.