Hi,
Yesterday i deleted one indexed iis logfile.
But now i want to analyze the indexed iis log file. Please help me on this.
Splunk remembers that it has already indexed that file in the fishbucket. You could either modify the file header, or provide a crcsalt in your inputs.conf. Emptying the fishbucket will affect other inputs on that machine.
delete events from index...... using command source="D:\desktop\iislog server 8\14.8\W3SVC2\u_ex140711.log" aspx | delete
Again i want to index the same file.its is not working please help me on this.
Have you deleted the file from the source machine or the events from the index or both?
i want to analyze the same log file what i have deleted
