Getting Data In

replacing inputs.conf

heterodyned
Path Finder

This would be a very trivial question, but what are the circumstances when splunk re-indexes new data? Replacing an existing inputs.conf with another inputs.conf shouldnt actually re-index data, but incase I need to perform a re-indexing, then would it be by clearing the data and then restarting splunk services?

Thanks,

Tags (1)
0 Karma
1 Solution

Genti
Splunk Employee
Splunk Employee

im assuming that you do not just want to re-index the data and have duplicates in.
If what you would like to do is clean all of your existing data, and then re-indexing it all up again then you can do the following:

./splunk stop
./splunk clean eventdata index_name
./splunk start

For more info on this go here
Cheers,
.gz

View solution in original post

Genti
Splunk Employee
Splunk Employee

im assuming that you do not just want to re-index the data and have duplicates in.
If what you would like to do is clean all of your existing data, and then re-indexing it all up again then you can do the following:

./splunk stop
./splunk clean eventdata index_name
./splunk start

For more info on this go here
Cheers,
.gz

Genti
Splunk Employee
Splunk Employee

replacing inputs.conf (and restarting the server) will only make the new data that comes in obey the rules in the new inputs.conf. The data that is originally there will not be reindexed and it will not change to obey the new rules. For reindexing you will need to use the clean command, or perhaps use crcSalt

0 Karma

heterodyned
Path Finder

Alright, I was wondering to replace our existing inputs.conf with the same copy of inputs.conf but with some modifications/flags like sourcetype/hostname etc...

0 Karma

Genti
Splunk Employee
Splunk Employee

If it is the same exact inputs.conf then no, you should see no other data. If you add some other monitor stanza or any other flags in the inputs.conf (such as crcSalt) the you might see more data/duplicates

0 Karma

heterodyned
Path Finder

So replacing inputs.conf from existing locations shouldnt cause duplicate data right?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...