Due to some error, i had deleted the test123 indexes at indexer, restart the indexer, create the test123 again. But somehow the data does not index anymore?
Splunk keeps track of what was indexed and therefor does not re-index the same data again .... unless you do some work.
The radical method is to clean the fishbucket index. That will remove the memory of every files, be warned it will re-index all data.
splunk clean eventdata -index _fishbucket
You could selectively forgot a single file from the fish bucket like this:
splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset
You could manually re-index each file with the
splunk add oneshot "/path/to/my/file.log" -sourcetype mysourcetype
You could modify the first line of the files to re-index, by default Splunk checks the first 256 chars of a file to differentiate them. If you had a simple comment on the first line it wil reindex it
You could change the crcSalt, create a new input for a new folder, add all the correct sourcetypes, etc... add the option
crcSalt=<SOURCE> then move or copy the files to be re-index to the folder.
hope this helps ...