Getting Data In

Why I cant reindex my log data after two consecutive cleaning of index?

shariinPH
Contributor

Hi all,

Im having trouble with re indexing my logs after i did twice index clean up.

I have here my inputs.conf in my forwarder

[monitor://G:\OpData\Operation\Uploadrb\...\*.TXT]
disabled = false
index = mynld_readbill
sourcetype = rbill_ul_mru
ignoreOlderThan = 30d
recursive=true
crcSalt=<SOURCE>
_TCP_ROUTING=mynlddev

for my props.conf in indexer

[rbill_ul_mru]
DATETIME_CONFIG = NONE
MAX_TIMESTAMP_LOOKAHEAD = 150
MAX_DAYS_HENCE = 15
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1

why can't I re index the logs?
i already did the splunk clean eventdata -index mynld_readbill in my indexers CLI and splunk clean all in my forwarder
Is there anything that I need to configure?
please send me some help dear splunkers.

0 Karma
1 Solution

satishsdange
Builder

You should clean fishbucket as well on UF. Please see below -

~/splunkforwarder/bin/splunk stop
rm -r ~/splunkforwarder/var/lib/splunk/fishbucket ~/splunkforwarder/bin/splunk start 

View solution in original post

0 Karma

satishsdange
Builder

You should clean fishbucket as well on UF. Please see below -

~/splunkforwarder/bin/splunk stop
rm -r ~/splunkforwarder/var/lib/splunk/fishbucket ~/splunkforwarder/bin/splunk start 

View solution in original post

0 Karma

shariinPH
Contributor

hi @satishsdange , im using windows OS for this. can you help me?

0 Karma

schose
Builder

same on windows.. delete c:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\ , restart the forwarder and data will come in again.

shariinPH
Contributor

@schose and @satishsdange.. will this affect my other indexes? for example i just want to clean a specific index. what should i do ?

0 Karma

schose
Builder

Deleting the fishbucket will be like reinstall the universal forwarder. All local data will be indexed again. if you index your data do different indexex you have to be careful as this end up in double events.

Regards,

Andreas

0 Karma

shariinPH
Contributor

thanks Andreas , but is it okay if i want to clean everything and i will change the names of my indexes then proceed with the indexing?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!