Getting Data In

force UF to reindex remotedly

ribentrop
Explorer

Hello!
Our Customers' environment is a large pool of windows/linux servers with logs of many forms.
Sometimes when constructing props or other conf files I strongly need to reindex data. So I want to clean forwarder's fishbacket.
I don't have physical access to servers when forwarders installed no administrative privileges to do it remotely.
The procedure "./splunk stop -clean fishbacket- ./splunk start" is not for me. And I don't want to bother the customer with my "clean fishbacket script"
As far as I know I can use REST API calls to somehow manage forwarders. I exactly can reload UF and it works.
Can I use REST API to force UF to reindex?
Is there any other way to clean fishbacket in my case?
I think my situation is rather typical, so I believe the solution should exist.
Thanks a lot!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Use offline data indexed into a temporary testing index for build your props.conf, and only enable your forwarders on the real data once you have the settings correct. That way you won't need to frequently clean fishbuckets and reindex stuff.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Use offline data indexed into a temporary testing index for build your props.conf, and only enable your forwarders on the real data once you have the settings correct. That way you won't need to frequently clean fishbuckets and reindex stuff.

0 Karma

ribentrop
Explorer

Uff.... That's the thing I started to do at the begining of my activities. I created TEMP index for test purposes, but then I abandoned it for quicker results.. Hurry is not a good thing.
Thanks a lot!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...