splunk changes not reflecting

[joydeep741]

I configured my server logs in splunk.
When I saw the logs in splunk I realized I set up some wrong properties in props.conf.

Now I rectify the properties in props.conf and restart server.

Somehow I still see the same logs on splunk front end, as they were before I rectified the issue in conf file.

Is there a way to know, if Splunk is picking logs from NEW INDEX ?
It seems it is picking logs from the index the got created the first time around.

[skoelpin]

Since props.conf lives on the indexer, it means that if you make changes then it will only affect new data being indexed, so it will not work retroactively. The only way to make changes retroactively is at search time

To solve your problem, I would reccomend deleting the data from the index and reindexing the new data with the correct props.conf configuration

To remove data from the index

sourcetype=YOUR_SOURCETYPE | delete

To Reindex your new data

Do a oneshoot to reindex your data, go to your forwarder and to the splunk/bin folder

./splunk add oneshot /full/path/to/file -sourcetype mysourcetype -index myindex -host myhostparam

[richgalloway]

Your changes will only affect new events. Anything indexed before you changed props.conf will continue to have the wrong properties. Are you sure you're looking at new data?