clearing buffered events

[mcbradford]

We have a system where the log rotation confuses splunk and splunk starts attempting to reindex the log. This happened 3 days ago and we Splunk is still trying to catch up. How can I clear the "buffer" and just tell splunk to start from this point forward? I think the throughput is saturated and it is sending as many events it can. When the problem started, we were getting about 9400 duplicate events per 1 event. We are now at about 50 to 1. Any ideas on how to make this stop?

[kristian_kolb]

There are probably several possible reasons for why this is happening, but it's hard to tell from the limited information.

Have you tried playing with the ignoreOlderThan and followTail parameters for inputs.conf?

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

/Kristian