Knowledge Management

How do I get an existing index to freshly re-index the same data input directory

scodenton
Engager

Hi,

I accidentally truncated my index by dropping the index limit by 3 orders of magnitude. Instead of years of data, I now have a couple of days, but of course, Splunk won't re-index the existing old files that are still there in the data input directory.

Does anyone know how to simply trip Splunk into freshly re-indexing an index from scratch? Would it be as simple as deleting the data input directory entry and re-adding?

Do I need to delete the whole index and start again?

I don't want to delete the whole fishbucket, as there are many other indexes that are fine and that I would like to keep as-is.

I have 2,800 files to reindex, so not an option to manually add each one in via CLI.

Any thoughts most welcome,

Kind regards,

Scott

0 Karma
1 Solution

woodcock
Esteemed Legend

If these are files, you can write a script to call splunk add oneshot which ignores the fishbucket:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/MonitorfilesanddirectoriesusingtheCLI

View solution in original post

woodcock
Esteemed Legend

If these are files, you can write a script to call splunk add oneshot which ignores the fishbucket:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/MonitorfilesanddirectoriesusingtheCLI

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...