Reset Splunk Data

[singhvikas]

Hey guys,

Let's say I have an index called test. 

I am only ingesting EVTX by modifying the inputs.conf 

[monitor://D:\winevt\logs\*]
index = test
sourcetype = preprocess-winevt
crcSalt = <SOURCE>

Now there's an extra huge EVTX which is very slow to index and I want to just start afresh! What approach should I take? 

I would like to - 

splunk stop
splunk clean eventdata
splunk start

but would it:

1. Rest my inputs.conf? I guess no

2. If not, wouldn't it again start indexing from where I left off(given I have not changed the input and not touched the physical files)? This is what I'm seeing in my environment. 

Thanks,

Vikas

[singhvikas]

Hi @gcusello 

Thank you for your response, I appreciate the help (and the word of caution!) 

Umm.. just to be clear, if the data is STILL being indexed. I can 

splunk stop
splunk clean eventdata
splunk start

what happens when splunk starts? It will start the indexing from scratch as per my configuration here? 

[monitor://D:\winevt\logs\*]
index = test
sourcetype = preprocess-winevt
crcSalt = <SOURCE>

[gcusello]

Hi @singhvikas,

Splunk doesn't index twice a log, so the already indexed data will not be indexed again by default.

If you need to reindex them, you have to change the name of filename and use (as you are doing) crcSalt = <SOURCE> option in your input stanza.

Ciao.

Giuseppe

[gcusello]

Hi @singhvikas,

if you're speaking of a development index, you could also use the delete command that's faster than the other way but it doesn't delete events from the index, it only marks them as deleted.

Anyway the approach you described is the correct one but BEWARE: if you don't insert the clause "-index <index_name>" in the command you clean all the indexes not only the test one!!!

Ciao.

Giuseppe