Getting Data In
Highlighted

Reset SplunkLightForwarder

Explorer

How may I reset a SplunkLightForwarder so that it will start from scratch and re-forward all data again? (v4.1.3)

Tags (1)
Highlighted

Re: Reset SplunkLightForwarder

Splunk Employee
Splunk Employee

hmm you can try:
./splunk stop
./splunk clean all
./splunk start

I believe when you do the above, it forgets about what files it has indexed and starts the indexing from the beginning.

Let me know if this worked for you. Cheers, .gz

(ps. make sure you are doing this from the forwarder...)

View solution in original post

Highlighted

Re: Reset SplunkLightForwarder

Explorer

I switched to SplunkForwarder (for other reasons). This solution does work for SplunkForwarder. It seems like kind of a big hammer to use on this nail, but in my case it's a satisfactory solution. Thank you very much.

0 Karma