Knowledge Management

How do I get an existing index to freshly re-index the same data input directory

scodenton
Engager

Hi,

I accidentally truncated my index by dropping the index limit by 3 orders of magnitude. Instead of years of data, I now have a couple of days, but of course, Splunk won't re-index the existing old files that are still there in the data input directory.

Does anyone know how to simply trip Splunk into freshly re-indexing an index from scratch? Would it be as simple as deleting the data input directory entry and re-adding?

Do I need to delete the whole index and start again?

I don't want to delete the whole fishbucket, as there are many other indexes that are fine and that I would like to keep as-is.

I have 2,800 files to reindex, so not an option to manually add each one in via CLI.

Any thoughts most welcome,

Kind regards,

Scott

0 Karma
1 Solution

woodcock
Esteemed Legend

If these are files, you can write a script to call splunk add oneshot which ignores the fishbucket:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/MonitorfilesanddirectoriesusingtheCLI

View solution in original post

woodcock
Esteemed Legend

If these are files, you can write a script to call splunk add oneshot which ignores the fishbucket:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/MonitorfilesanddirectoriesusingtheCLI

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...