upload deleted iis log file

[nkarthiece]

Hi,

Yesterday i deleted one indexed iis logfile.

But now i want to analyze the indexed iis log file.
Please help me on this.

[martin_mueller]

Splunk remembers that it has already indexed that file in the fishbucket. You could either modify the file header, or provide a crcsalt in your inputs.conf. Emptying the fishbucket will affect other inputs on that machine.

[nkarthiece]

delete events from index...... using command
source="D:\desktop\iislog server 8\14.8\W3SVC2\u_ex140711.log" aspx | delete

Again i want to index the same file.its is not working
please help me on this.

[martin_mueller]

Have you deleted the file from the source machine or the events from the index or both?

[nkarthiece]

i want to analyze the same log file what i have deleted