Getting Data In

splunk changes not reflecting

joydeep741
Path Finder

I configured my server logs in splunk.
When I saw the logs in splunk I realized I set up some wrong properties in props.conf.

Now I rectify the properties in props.conf and restart server.

Somehow I still see the same logs on splunk front end, as they were before I rectified the issue in conf file.

Is there a way to know, if Splunk is picking logs from NEW INDEX ?
It seems it is picking logs from the index the got created the first time around.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Since props.conf lives on the indexer, it means that if you make changes then it will only affect new data being indexed, so it will not work retroactively. The only way to make changes retroactively is at search time

To solve your problem, I would reccomend deleting the data from the index and reindexing the new data with the correct props.conf configuration

To remove data from the index

sourcetype=YOUR_SOURCETYPE | delete

To Reindex your new data

Do a oneshoot to reindex your data, go to your forwarder and to the splunk/bin folder

./splunk add oneshot /full/path/to/file -sourcetype mysourcetype -index myindex -host myhostparam

richgalloway
SplunkTrust
SplunkTrust

Your changes will only affect new events. Anything indexed before you changed props.conf will continue to have the wrong properties. Are you sure you're looking at new data?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...