Getting Data In

force UF to reindex remotedly

ribentrop
Explorer

Hello!
Our Customers' environment is a large pool of windows/linux servers with logs of many forms.
Sometimes when constructing props or other conf files I strongly need to reindex data. So I want to clean forwarder's fishbacket.
I don't have physical access to servers when forwarders installed no administrative privileges to do it remotely.
The procedure "./splunk stop -clean fishbacket- ./splunk start" is not for me. And I don't want to bother the customer with my "clean fishbacket script"
As far as I know I can use REST API calls to somehow manage forwarders. I exactly can reload UF and it works.
Can I use REST API to force UF to reindex?
Is there any other way to clean fishbacket in my case?
I think my situation is rather typical, so I believe the solution should exist.
Thanks a lot!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Use offline data indexed into a temporary testing index for build your props.conf, and only enable your forwarders on the real data once you have the settings correct. That way you won't need to frequently clean fishbuckets and reindex stuff.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Use offline data indexed into a temporary testing index for build your props.conf, and only enable your forwarders on the real data once you have the settings correct. That way you won't need to frequently clean fishbuckets and reindex stuff.

0 Karma

ribentrop
Explorer

Uff.... That's the thing I started to do at the begining of my activities. I created TEMP index for test purposes, but then I abandoned it for quicker results.. Hurry is not a good thing.
Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...